Access to production systems and customer data is strictly need-to-know. Only authorized devices may connect to production infrastructure, and all personnel access follows the principle of least privilege. Background checks are conducted for anyone with access to customer data or production systems. Access is provisioned by role at onboarding and revoked within 24 hours of departure. All access to sensitive data is audit-logged with actor identification, IP address, and before/after state snapshots. Sensitive fields like tokens and passwords are automatically sanitized before being written to logs.

At the moment only Gibson has access.

Customer data is retained for the duration of the active service relationship, plus any period required by legal or regulatory obligations. Audit logs are retained indefinitely as immutable, append-only records to preserve full financial history and support compliance. When a customer requests account deletion, a cascading deletion process removes their organization, financial records, and associated data from the active database. Database backups follow Supabase's retention schedule with daily snapshots and point-in-time recovery.

https://grainledger.com/security

.

We plan to work with Rhino and/or Cobalt on Pen testing in July, our path to pursuing SOC II is probably not until early 2027.

If your team has pen testing recommendations outside of those two partners I mentioned I would to know.

Hope this is sufficient to allow us to continue with beta testing. Let me know if they have any questions or want to see anything else.