Last updated: [date — set on publish]
Tenant isolation, enforced by the database
Every campaign’s data is isolated at the database level, not just hidden behind a login screen. Isolation is enforced by Postgres row-level security itself — a bug in a screen can never leak another campaign’s rows.
No stored passwords
We don’t store passwords. Sign-in runs through a dedicated identity provider (WorkOS) with multi-factor authentication available.
Encryption in transit and at rest
Data is encrypted end to end — in transit and at rest — with no plaintext endpoints.
Sensitive data is role-scoped and audited
Voter ID, date of birth, phone, address, and party affiliation are treated as sensitive: access is scoped by role, and sensitive actions — exports, access changes, voter-data edits — write to a permanent, append-only audit trail.
We’re early, and honest about it
We don’t claim certifications or audits we don’t have. If a security review is part of your evaluation, ask us directly — we’ll tell you exactly where things stand.