Accounts
Portal features require an authenticated account. Public pages and the prospect intake form do not require an account, and the intake form only accepts the business details shown on the form.
Data access
Row-level security is enabled on customer-data tables. Access rules are evaluated in the database on every request, so each account can only reach its own records. Administrative access is granted through a separate roles table and checked server-side, never from client-side flags or user-editable profile data.
Documents
Uploaded documents are stored in a private bucket that is not publicly readable. Access policies scope files to the account that owns them, with administrative access limited to authorized roles.
Privileged operations
Administrative reads and writes run through server-side functions that re-verify the caller's role before any data is returned or changed. Submitted form data is validated in the database, and internal sales fields cannot be set by a public submission.
Payments
When checkout is used, payment details are collected and processed by our third-party payment provider. Card numbers are never entered into or stored by AccountiTech.
Transport
When deployed, the site is served over HTTPS by our hosting platform, which terminates TLS for all traffic.
Shared responsibility
AccountiTech is responsible for the platform and service delivery. Customers are responsible for safeguarding their account credentials and for the accuracy and completeness of the records they provide.
Security questions and reports
Use our contact page or email founder@accountitech.com to report a suspected vulnerability or ask a security question, and we will follow up directly.
This page describes controls currently enabled in our application. It is not an attestation, certification, or audit report.