Secure authentication
Supabase Auth manages account authentication. Passwords are securely hashed by the authentication provider and are not stored in Startup To Corporate's application tables.
Security
Designed to keep each workspace private and separated.
Startup To Corporate uses layered access controls and established service providers to protect customer accounts and company records.
Tenant-isolated data
Database row-level security restricts records to members of the correct company or individual workspace.
Private document access
Document files are stored privately. Original downloads use authorized server endpoints that check workspace access. Delegated downloads require a current scoped grant and a clean inspection result. Files flagged as infected are quarantined; an unconfigured scanner must not be mistaken for a clean scan.
MFA and enterprise identity
Accounts can enroll an authenticator app. Workspace MFA and enterprise SSO/SCIM controls depend on workspace policy and identity-provider configuration; they are not automatically enforced for every account. External identity-provider acceptance remains necessary.
Controlled staff access
Temporary support access uses scoped access windows and recorded events. This software control does not imply a staffed around-the-clock support commitment.
Portability and retention
Workspace exports include scoped metadata, and the Operations export workflow can package available originals with a manifest and hashes. Retention reviews and legal-hold records support deliberate decisions; no automatic retention purge or guaranteed recovery time is promised.
Encrypted connections
The hosted application and its service connections use HTTPS to protect information in transit.
Responsible access
Workspace roles limit administrative actions, and sensitive operations are checked on the server or by database policies.
Report a concern
Send suspected vulnerabilities or account-security concerns to security@startuptocorporate.com. Do not include passwords or sensitive records.
This page describes currently implemented safeguards. Startup To Corporate does not claim a security certification or guaranteed availability unless one is expressly documented.
A clearer next step