Trust & Safety

Security at Cash Flow Optimizer

When you use Cash Flow Optimizer, you trust us with your company's financial, customer, and business data. This page explains, in plain language, the key practices and safeguards we use to protect it.

Last Updated: July 20, 2026

Encryption

TLS (HTTPS) for every connection in transit. AES-256 encryption at rest on our infrastructure providers' managed platforms.

Infrastructure

Built on Vercel and Supabase — US-hosted providers with SOC 2 certifications and platform-level security programs.

Your Control

You own your data. Export it, disconnect any integration, or delete your account at any time.

This Security Overview is operated by RealtoResource, LLC (doing business as Solidify Solutions). It is provided for transparency and describes our practices as of the date above. It is not exhaustive, our practices evolve over time, and it does not create any warranty or contractual commitment beyond what is stated in our Terms of Service, Privacy Policy, and Data Processing Addendum. No online service can be guaranteed to be perfectly secure.

1. Your Data Belongs to You

You own your data. We act as a caretaker that processes your data to provide the Services. You control access to your account, you can export your data, you can disconnect any connected integration at any time, and you can delete your account — after which we delete or de-identify your data as described in our Privacy Policy and Data Processing Addendum.

2. Infrastructure and Hosting

We do not operate our own physical servers. Cash Flow Optimizer is built on established cloud platforms located in the United States:

  • Vercel hosts our application and serves it over encrypted connections.
  • Supabase provides our application database and authentication.

These providers maintain their own robust security programs and independent certifications (including SOC 2) for the infrastructure we build on, and provide platform-level protections such as network security and denial-of-service mitigation. You can learn more about their security practices at vercel.com and supabase.com.

3. Encryption

Your data is protected with encryption both in transit and at rest:

  • In transit: all connections to Cash Flow Optimizer are encrypted using industry-standard TLS (HTTPS).
  • At rest: data stored in our database is encrypted at rest using our infrastructure provider's industry-standard (AES-256) encryption.

4. Authentication and Access

Users sign in with an email or username and a password. Passwords are handled by our authentication provider and are stored only in hashed form — we never store your password in plain text. We are actively working to add multi-factor authentication (MFA) for user logins; see Section 13.

Access to your data within the application is governed by your account's roles and permissions, which you control. We recommend the account-security steps in Section 11.

5. Separation of Customer Data

Cash Flow Optimizer is a multi-tenant service, and each customer's data is logically separated from every other customer's data. We use Supabase Row-Level Security (RLS) and data-segmentation controls so that access to records is restricted to the account they belong to.

6. Who Can Access Your Data Internally

Cash Flow Optimizer is currently operated by a single founder. Internal access to production systems and customer data is therefore limited to the founder, and is used only when necessary to operate, maintain, support, troubleshoot, or secure the Services. Administrative access to our code and infrastructure (GitHub, Vercel, Supabase, and Stripe) is protected by the security controls of those platforms.

As we grow and bring on employees and contractors, we will implement personnel-security practices appropriate to our size, including confidentiality agreements, least-privilege and role-based access to production systems, prompt removal of access when someone leaves, and security awareness practices (see Section 13).

7. Backups and Availability

We rely on the automated backups provided by our database infrastructure provider (Supabase), and our providers (Vercel and Supabase) are designed for resilience and availability. We use commercially reasonable efforts to keep the Services available, but we do not guarantee any specific uptime, and the Services may be unavailable due to maintenance or events beyond our control.

Keep your own records. As noted in our Terms of Service, the Services are not a backup service. We recommend you maintain your own independent backups of critical data — for example, exporting reports or keeping your source records in your accounting system.

8. Integrations and Subprocessors

We connect to third-party services only through secure, authorized methods, and we rely on a small set of trusted providers to deliver the Services:

  • QuickBooks Online (Intuit): connected through Intuit's official OAuth API. We do not receive or store your QuickBooks login credentials.
  • Bank and credit-card data (Plaid): connected through Plaid. We do not receive or store your online-banking credentials.
  • AI features (Anthropic, Google, OpenAI): accessed through their paid business/developer APIs. Your data is not used to train their models, as described in our AI Disclosures & Additional Terms.
  • Email, calendar, messaging & social publishing (Unipile, postforme.dev): if you enable them, we use Unipile to connect your email, calendar, and social-media/messaging accounts (currently LinkedIn, WhatsApp, Instagram, Telegram, and Facebook Messenger) — including messages, comments, reactions, and calendar events — and postforme.dev to publish posts to your connected social accounts, based on the permissions you grant. Unipile hosts and processes data in France (EU); postforme.dev is a cloud-hosted service. You can disconnect these at any time. Automated messaging and engagement features are subject to each connected platform's own usage limits and may result in that platform restricting or suspending your account — see our Terms of Service.
  • Payments (Stripe): subscription payments are processed by Stripe, a PCI-DSS Level 1 certified payment processor. We do not store full payment-card numbers.
  • Hosting and database (Vercel, Supabase): as described in Section 2.

You can disconnect any integration at any time, which revokes our ongoing access to that service. A current list of the subprocessors that may process personal data is maintained in our Data Processing Addendum.

9. Secure Development

Our source code is maintained in a private repository (GitHub), and changes are deployed through a controlled deployment pipeline (Vercel). As our team grows, we intend to expand our secure-development practices, including code review and automated dependency scanning.

10. Vulnerability Reporting and Incident Response

We welcome responsible disclosure of security issues. If you believe you have found a vulnerability, please review and follow our Vulnerability Reporting Policy and contact us at support@cfoptimizer.com.

If we become aware of a security incident affecting your personal data, we will investigate, take appropriate remedial steps, and notify you without undue delay and as required by applicable law, consistent with our Terms of Service and Data Processing Addendum.

11. Your Role in Keeping Your Account Secure

Security is a shared responsibility. You can help protect your account by:

  • Using a strong, unique password that you do not use on any other site, and never sharing it.
  • Limiting the people you invite to your account, and giving each person only the access they need.
  • Signing out of shared devices and keeping your browser and devices up to date.
  • Notifying us promptly at support@cfoptimizer.com if you suspect any unauthorized access.

12. Data We Are Not Built to Store

Cash Flow Optimizer is designed to process your business's financial and operational data. It is not intended for the storage of Protected Health Information (PHI) subject to HIPAA (we do not offer a Business Associate Agreement), full payment-card data (other than as processed by Stripe for billing), or other specially regulated categories of sensitive data. Please do not submit such information except through features designed for it. See the Prohibited Data section of our Terms of Service.

13. What We're Continuing to Improve

We are a growing company and are continually strengthening our security program. Practices we are actively working toward include: multi-factor authentication for user logins; expanded activity logging and monitoring; formal personnel-security controls as we hire employees and contractors; and, as we scale, consideration of independent security assessments. We update this Security Overview as our practices evolve.

14. Contact

Questions about security, or want to report a concern?