Topout Tech, LLC — Security Overview

What this means (plain English)

• Everything runs on established US cloud infrastructure (Vercel, Supabase, Clerk); we don't operate our own servers.
• There are no passwords to steal: sign-in is passwordless via emailed codes/links.
• Your browser never talks to the database. Every read and write goes through our server code, which checks who you are and what firm/project you belong to before touching data.
• Each firm's data is isolated by those membership checks on every request, with a database-level lockdown as a second layer.
• Files upload over encrypted connections directly to private storage with size limits, and are fetched back only through permission-checked, expiring links.
• Expired demo workspaces are wiped automatically, files included.
• We are a young company: we do not yet hold SOC 2 or ISO certifications, and we say so rather than imply otherwise.
• Found a vulnerability? Tell us: security@topout.build.

Infrastructure

The Service runs entirely on managed cloud providers — Vercel (application hosting and compute), Supabase (PostgreSQL database and file storage), Clerk (identity), Resend (transactional email) — listed with their roles on the Subprocessors page. Topout operates no physical servers. Hosting is in the United States (primary data region: AWS us-east-1).

Encryption

• In transit: all connections use HTTPS/TLS — browser to app, app to database, app to vendors.
• At rest: database and file storage are encrypted at rest by our infrastructure providers.

Authentication

Sign-in is passwordless (email code / magic link) through Clerk, shared across all Topout apps. Topout never stores or transmits passwords, so there is no Topout password database to breach. Sessions are short-lived tokens scoped to .topout.build.

Authorization and tenant isolation

• No client-side database access. The database is reachable only from server-side code; browsers hold no database credentials of any kind.
• Every request is authorized server-side. Server code verifies the signed-in user and their membership in the specific firm or project before reading or writing, even when the UI already hides a control. Firm and project membership tables are the access boundary.
• Defense in depth: database-level row security is enabled as a backstop so that even a misconfigured client credential would read nothing. Server actions re-verify authorization individually rather than trusting upstream middleware.
• Administrative access to the platform's admin surface is restricted to a verified-email allowlist and re-checked on every administrative action.

File handling

Customer document uploads go directly from the browser to private storage over TLS using short-lived signed upload URLs, with per-file size limits (currently 50 MB). Downloads are served only through permission-checked, expiring links. Storage buckets are private; there are no public file URLs.

Data lifecycle

• Demo workspaces expire automatically (about 14 days); a nightly job permanently deletes expired demo firms, including their uploaded files.
• Customer data export and post-termination deletion follow the Terms of Service / Master Subscription Terms (30-day export window, then ordinary-course deletion).

Software development practices

• All input from users is validated on the server before it reaches the database.
• Changes are version-controlled, built and deployed through an automated pipeline, and secrets live only in server-side environment configuration (never in client code).
• Periodic internal security reviews are run across the platform (these are our own reviews, not third-party audits); the most recent full reviews found no critical or high-severity issues, and findings from earlier reviews were remediated.

What we do not claim

Topout does not currently hold SOC 2, ISO 27001, or similar third-party certifications, and we do not claim compliance frameworks we have not been audited against. As the company grows, formal audits are on the roadmap.

Incident response

If we become aware of a security incident affecting customer data, we will investigate, mitigate, and notify affected customers without undue delay — customers with a signed Data Processing Addendum are notified within the 72-hour window it defines — with the facts known and remediation steps.

Reporting a vulnerability

Report suspected vulnerabilities to security@topout.build. Good-faith research that respects other customers' data is welcome; we ask that you not access data that isn't yours and give us reasonable time to fix issues before disclosure.