How we protect your data
Security isn't a feature you toggle on — it's the baseline. Here's exactly how Retainer Burn is built to keep your clients and hours safe.
Encryption everywhere
All traffic between your browser and Retainer Burn is encrypted with TLS (HTTPS) — there is no unencrypted way to reach the app. Your data is also encrypted at rest in our managed Postgres database, so it's protected on disk, not just in transit.
Database-level data isolation (RLS)
This is the part we care about most. Every table that holds your data — clients, time entries, alerts, your profile — is protected by Row-Level Security (RLS) enforced by the database itself. Every query is automatically scoped to the signed-in account at the lowest level, which means one user's data is structurally unreachable by another — even if a bug slipped through the application code. Isolation doesn't depend on us writing every query perfectly; it's enforced underneath.
Authentication
Accounts are protected with email and password through a dedicated, industry-standard authentication service. Passwords are salted and hashed — we never see or store them in plain text — and sessions are managed with secure, HTTP-only cookies. Password resets use single-use, time-limited links sent to your email.
Secrets & access
Privileged credentials (such as the database service key) live only on the server and are never shipped to the browser or exposed in client code. Application secrets are stored as encrypted environment variables, not in our source code.
Infrastructure
We don't reinvent the hard parts. Retainer Burn runs on SOC 2-compliant infrastructure — Vercel for the application and Supabase for the database and authentication — both of which maintain their own security programs, audits, and automated backups of your data.
Responsible disclosure
If you believe you've found a security vulnerability, please email security@retainerburn.com with the details and steps to reproduce. We'll acknowledge your report, keep you updated on the fix, and we won't pursue or support legal action against researchers acting in good faith who avoid privacy violations and service disruption.
What we're still building
We believe in being honest about where we are. Retainer Burn is a young product. Things on our security roadmap that aren't here yet include two-factor authentication (2FA), single sign-on (SSO), and a formal, independently audited compliance certification of our own. We'll update this page as those ship.
Questions about any of this? Reach us through the contact page.