Security
Your telecom records, kept the way your finance team expects.
Plain answers to the questions an IT director, a CFO and a risk team ask before they put a company's contracts and bills in a new system. If a question is missing, email us and we will answer it here.
Where your data lives
In a dedicated Postgres database and file store on Supabase, hosted on AWS in the United States (us-east-1). The application runs on Vercel. Nothing is stored on laptops or in email.
Encryption
Encrypted in transit (TLS) between your browser and the application, and between the application and the database. Encrypted at rest on disk. Uploaded bills and contracts sit in a private bucket that is never publicly readable.
Who can see what
Each company's records are separated in the database itself by row-level security, not just in the application. An advisor sees only the clients that granted access. Admins, members and read-only viewers are set per workspace by your own admin.
Signing in
No passwords to leak. People sign in with a one-time emailed link, or with their work Google or Microsoft account where the workspace admin has turned that on. Sessions expire and are refreshed per device.
Everything is recorded
Every change to a record carries who made it and when, and the previous value is kept. When DemarcLabs staff open a workspace to help, the visit is read-only and shows in that workspace's own history.
Leaving
Your inventory, renewals and full history export to CSV at any time, from inside the product. Ask us to delete a workspace and it is gone within 30 days, apart from billing records we must keep.
Who else handles your data
The services behind DemarcLabs
We run on a short list of well-known providers and add to it only when a feature needs it. Each one sees only what its job requires. Documents go to the reader only when you ask for a bill, contract or quote to be read.
| Provider | What it does for you | Where |
|---|---|---|
| Supabase | Database, file storage and sign-in | United States |
| Vercel | Application hosting and delivery | United States |
| Resend | Sign-in links and email alerts | United States |
| OpenAI | Reading documents you upload (bills, contracts, quotes); not used to train models | United States |
| Stripe | Subscription billing; card numbers never reach us | United States |
| Cloudflare | DNS for demarclabs.com | Global |
What we will put in writing
- A data processing agreement covering the providers above, on request, before you sign.
- Your security questionnaire, completed and returned within five business days.
- Our own rules: customer data is never used for marketing, never shared with a carrier or another customer, and never leaves your workspace without an explicit, revocable authorization from your admin.
Straight answers
- Certifications. DemarcLabs is a young company and does not hold a SOC 2 report yet. Our hosting providers do; we will share their reports and our own roadmap on request.
- Backups. You can export everything at any time. Automated point-in-time database backups are switched on with the first paid plan tier, before we charge anyone.
- Found something? Email hello@demarclabs.com with the word Security in the subject and a person reads it the same day.