Trust Center
Built for diligence-grade data. Shepi handles seller financials, bank statements, and accounting integration data with the controls a PE associate or SBA lender expects — and this page is an honest description of what's actually in place today, not marketing puffery.
At a Glance
TLS 1.2+
In transit
AES-256
At rest
SOC 2 + ISO 27001
Certified infrastructure
Per-deal RLS
Tenant isolation
Zero retention
AI + customer data
Data Handling
Customer data lives in a Postgres database hosted by Supabase on AWS infrastructure in the United States. Uploaded documents (bank statements, GLs, payroll, contracts) are stored in Supabase Storage in the same region. All traffic between your browser, our edge functions, and the database is encrypted in transit with TLS 1.2 or higher; storage at rest is AES-256.
What we collect
Account email, organization name, billing details, the financial documents you upload, and the GL/bank data fetched from your accounting integration once you connect it.
Where it lives
Postgres on Supabase, US region. Documents in Supabase Storage, US region. No copies in third-party drives.
Retention defaults
Project data is retained for the life of the account so you can re-open historical deals. You can delete a project and its documents from the dashboard at any time.
Customer-initiated deletion
Project delete is one click. For full account deletion or a data export, email hello@shepi.ai — handled within 30 days.
Authentication & Access
Authentication is handled by Supabase Auth (email/password with optional Google OAuth). Inside the database, every customer-facing table uses Postgres Row Level Security so a request scoped to your session only sees rows owned by your account or projects you've been invited to.
Per-deal isolation
RLS policies key off the authenticated user ID for every read and write. There is no "read all" path from the client.
Role separation
Deal owner, invited collaborator, CPA reviewer (on DFY engagements), and platform admin are distinct roles enforced in a dedicated user_roles table — never on the profile record.
Session handling
JWTs issued by Supabase Auth, short-lived access tokens with refresh rotation. Sign-out invalidates the session client-side and the refresh token server-side.
Password reset
Self-service via emailed signed link. We never see or store plaintext passwords.
AI & Customer Data
Shepi uses large language models to parse documents, classify GL entries, and draft narrative sections. All LLM calls route through the Vercel AI Gateway under a zero-data-retention agreement. Upstream model providers — currently Anthropic Claude and OpenAI — process those requests as sub-processors under the same no-retention terms. Your data is not used to train any model.
Extracted fields and AI-generated drafts are stored against your deal record so you can review, override, and audit them. CPA review (on DFY engagements) is human-in-the-loop on the adjustments before any export.
Infrastructure
Hosting
Front end on Lovable's edge network. Database, auth, storage, and edge functions on Supabase (AWS US).
Backups
Daily automated database backups managed by Supabase with point-in-time recovery on the production plan.
Logging & monitoring
Edge function logs and database query logs retained in Supabase. Errors surfaced to the engineering team in real time.
Subprocessors
Full list at /subprocessors — who has access to what, and why.
Compliance & Certifications
Shepi runs on infrastructure that is independently audited to SOC 2 Type II and ISO 27001. The platform inherits the physical, network, and operational controls of every subprocessor that touches customer data. Shepi itself has not yet completed an independent SOC 2 or ISO 27001 audit — that's on the roadmap below. The distinction matters; here is exactly what is and isn't certified.
Infrastructure certifications (inherited)
| Provider | Role | Certifications | What we inherit |
|---|---|---|---|
| AWS (us-east) | Underlying compute, network, storage | SOC 1 / 2 / 3 Type II · ISO 27001 / 27017 / 27018 · PCI DSS L1 · HIPAA-eligible | Physical security, network controls, hardware lifecycle |
| Supabase | Database, auth, storage, edge functions | SOC 2 Type II · HIPAA available | Database hardening, backup operations, access logging |
| Vercel | Hosting, AI Gateway | SOC 2 Type II · ISO 27001 · GDPR | Edge delivery, build pipeline, zero-data-retention LLM routing |
| Stripe | Billing | PCI DSS L1 · SOC 1 / 2 Type II | Cardholder data handling — Shepi never touches card numbers |
What Shepi itself controls
Certified infrastructure is necessary but not sufficient. The application layer on top is on us:
RLS policies
Every customer-facing table enforces Postgres Row Level Security keyed to the authenticated user — no "read all" path from the client.
Role separation
Deal owner, collaborator, CPA reviewer, and admin roles live in a dedicated user_roles table with security-definer functions; never on the profile record.
Secret management
Service-role keys and third-party API credentials live in Supabase Edge Function secrets, never in client code, never in the database.
Code review & dependency scanning
Every change is reviewed before merge. Dependencies scanned for known vulnerabilities on each build.
Shepi's own audit status
Shepi has not yet completed an independent SOC 2 or ISO 27001 audit. SOC 2 Type I is on the roadmap below. Enterprise prospects can request our current security questionnaire (CAIQ-lite format) and a summary of inherited controls under NDA — email hello@shepi.ai.
Zero Data Retention
Customer financial data — from any accounting integration, uploaded statements, GL detail — is ingested, analyzed, and returned as deliverables. We do not retain it for secondary use, do not sell it, do not share it, and do not use it to train any model. For AI-assisted analysis, prompts route through the Vercel AI Gateway to Anthropic under no-retention, no-training terms.
No model training
Your data is never used to train foundation models or any Shepi model.
No retention beyond the engagement
Customers can purge project data at any time; we retain only what's needed to deliver the project and meet legal or tax obligations.
No human review of customer data
Internal staff do not browse customer data. Access is role-scoped and audit-logged.
No secondary use
Data is never repackaged, resold, or used for benchmarking, analytics products, or marketing.
How each data flow is handled
| Data flow | Retention posture |
|---|---|
| Prompts and completions to Claude via Vercel AI Gateway | Zero retention, zero training (upstream contractual) |
| Document text extracted for AI analysis | Processed in-request; not stored on AI sub-processor side |
| Accounting integration data + financial data in Postgres | Held only for the active engagement; purged on customer request; never sent to LLMs in raw form and never used to train models |
| Files at rest in Supabase Storage | Encrypted at rest; scoped to the project; deleted with the project |
| Application logs (Vercel, Supabase) | Operational only; standard short retention; no customer financial content |
No separate ZDR contract is required — the no-retention posture flows from Shepi's architecture and Vercel AI Gateway's upstream agreement with Anthropic. See DPA §6 (AI Sub-processors) and the full subprocessors list. Enterprise prospects can request the current data-flow diagram under NDA — email hello@shepi.ai.
What We Don't Have Yet
Overclaiming on security is a bigger risk than underclaiming, so here's the honest list of what we have not shipped:
- No independent SOC 2 report for Shepi itself. Type I is on the roadmap below. Underlying infrastructure (AWS, Supabase, Vercel) is SOC 2 Type II and ISO 27001 certified today.
- No third-party penetration test report. We do internal review on every release; an external annual pen test is on the roadmap.
- No HIPAA, PCI, or FedRAMP coverage. Shepi is not designed for protected health information, cardholder data, or federal-government workloads.
- No SAML SSO. Email/password and Google OAuth today. SAML for DFY accounts is on the roadmap.
- No published bug bounty payouts. We credit researchers on the responsible-disclosure page; cash bounties are not in place yet.
Roadmap
These are goals, not commitments — dates will move as the business does. We publish this list so prospects can see direction.
SOC 2 Type I scoping
Auditor selection and control mapping underway. Targeting a Type I report within 12 months, then Type II 6–12 months after.
Annual third-party penetration test
External pen test on a fixed annual cadence, with a summary letter available to enterprise prospects under NDA.
SAML SSO for DFY accounts
Okta / Azure AD / Google Workspace SAML for accounts on the DFY tier.
In-app data export
Self-serve export of all deal data (workbook + uploaded docs + AI extractions) without contacting support.
Contact
Security questions, DPA requests, or vendor questionnaires: hello@shepi.ai. To report a vulnerability, see the responsible disclosure policy.