Trust & Security
What's actually true today โ no unverified certifications, no vague claims.
Encryption in transit and at rest
TLS for all connections; data at rest is encrypted by our infrastructure providers (Supabase/Postgres, Cloudflare R2).
India data region
Primary database runs in Supabaseโs Mumbai (ap-south-1) region.
Tenant isolation, enforced and tested
Row-level security scopes every customerโs data by tenant. Audited and hardened 2026-07-21 โ several real gaps were found and fixed; see our engineering changelog for specifics rather than take our word for it.
Audit trail on agent actions
Every automated agent action is logged with a full trail โ what was planned, why, and the outcome. High-risk actions (sending a message, moving money) require human approval before they execute.
Two-factor authentication (MFA)
Real TOTP-based MFA is available on your account โ not just a checkbox in a settings table.
Not yet true โ stated plainly
No SOC 2 or ISO certification exists yet. We do not claim "zero-knowledge" architecture: our team can access your data through normal backend administration, same as any SaaS platform without end-to-end client-side encryption. KYC review is manual, not an automated regulatory certification.
Found a security issue? Email security@capitalsync.net.