Security & Data Retention

• Email + password sign-in, OAuth providers, and optional passkeys (WebAuthn).
• Cloudflare Turnstile challenges on sign-up, password reset, and communication changes.
• Idle-session timeout and automatic token refresh.
• Per-user data isolation enforced at the database with row-level security.
• Administrative actions are gated by a server-side role check, not client flags.

• Application data is stored in Supabase (managed Postgres + object storage).
• Server functions and API routes run on Cloudflare Workers at the edge.
• All traffic is encrypted in transit (TLS). Data at rest is encrypted by the platform providers.
• User uploads live in per-user storage buckets and are only served through signed URLs.

• Supabase — database, authentication, storage.
• Cloudflare — edge hosting, DNS, Turnstile bot protection.
• Resend — transactional and communication emails.
• Stripe and Paddle — payment processing for subscriptions.

We only keep operational data for as long as we need it. Current windows:

• Email send logs — 90 days
• Email verification tokens — deleted on use or expiry
• Email unsubscribe tokens — 30 days
• Data-export requests and generated files — deleted at expiry
• Contact-form messages — 2 years
• Unsubscribed newsletter records — 30 days after unsubscribe
• Account data (profile, invoices, expenses, cue lists, uploads) — retained while your account is active; removed on account deletion

These windows are enforced automatically by scheduled database jobs. Windows may change as the product evolves; material changes will be reflected here.

You can delete your account at any time from Settings. Deletion is one-click and removes:

• Your profile, invoices, invoice clients, expense items and claims, cue lists, tags, and other user-scoped records.
• Uploaded files across avatars, support attachments, and data-exports storage buckets.
• Your Stripe customer record (subscriptions cancelled and customer deleted).
• Your membership in every Resend audience used for communications.

Note: Paddle's API does not currently support customer deletion. Where Paddle was used for billing, active subscriptions are cancelled and the customer record is archived rather than deleted.

You can request a full export of your data from Settings. Exports are generated in chunks so large accounts don't overload the system, and progress is shown live in the app.

• Download links are delivered by email from comms@backline-hq.com.
• Downloads use short-lived signed URLs (60 seconds) minted on demand and scoped to your account.
• Rate-limited to one export every 72 hours per account.

For privacy requests, security reports, or questions about this page, email support@backline-hq.com. Please do not include passwords or other secrets in your message.

Backline is not yet certified or audited under any formal security framework. Our roadmap is:

• SOC 2 Type II — planned. We will implement the required controls, collect evidence over an audit period, and engage a licensed CPA firm to issue an attestation report.
• ISO 27001:2022 — planned. We will build an information security management system (ISMS) and pursue certification through an accredited body.
• HIPAA — not currently in scope. Backline does not process protected health information (PHI), so HIPAA compliance is not required today.
• PCI DSS — scope is minimized. We do not store, process, or transmit cardholder data in our own systems. Payments are handled through Stripe, which keeps our PCI scope to the lowest applicable self-assessment level.

Lovable (the platform Backline is built on) maintains its own SOC 2 Type II and ISO 27001:2022 certifications for the Lovable Enterprise plan. Those cover the platform, not this app, and do not automatically make Backline compliant. We will pursue our own independent reports.

If you need a specific report or certification for a contract, email us at support@backline-hq.com so we can prioritize the right framework and timeline.

Backline is not currently certified under SOC 2, ISO 27001, HIPAA, or PCI. This page describes the controls that are enabled in the product today; it is not a substitute for a formal audit or a data-processing agreement.