Security

Your data is protected at every layer.

ACCESS is built on infrastructure that meets enterprise-grade security standards. Here's exactly what protects your workspace.

TLS 1.2+

All traffic encrypted in transit

AES-256

Data encrypted at rest

PCI-DSS

Payment data via Stripe

SOC 2

Auth via Clerk (SOC 2 Type II)

HTTPS Only

HSTS enforced via Vercel

NACHA

ACH governed by federal rules

Infrastructure security

  • ✓All platform traffic encrypted with TLS 1.2+ via Vercel Edge Network
  • ✓Strict-Transport-Security (HSTS) enforced with max-age 63,072,000 seconds
  • ✓HTTP security headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
  • ✓Data stored in Supabase with AES-256 encryption at rest
  • ✓Database connections use SSL-enforced certificates
  • ✓Vercel Edge Functions run in isolated execution environments

Authentication and identity

  • ✓Authentication powered by Clerk (SOC 2 Type II certified)
  • ✓Support for multi-factor authentication (MFA) via TOTP and SMS
  • ✓Session tokens are short-lived and rotated on sensitive operations
  • ✓OAuth 2.0 flows for social sign-in (Google) with PKCE protection
  • ✓Passwords are hashed using bcrypt with a minimum cost factor of 12
  • ✓Account lockout after repeated failed authentication attempts

Payment security

  • ✓All payment processing handled by Stripe, Inc. (PCI-DSS Level 1 certified)
  • ✓We never store full card numbers, CVVs, or bank account numbers
  • ✓Only Stripe Customer IDs and payment method references are stored
  • ✓ACH transactions governed by NACHA Operating Rules
  • ✓Stripe uses TLS 1.2+ for all payment API calls
  • ✓3D Secure authentication available for card payments on high-risk transactions

Application security

  • ✓Clickjacking protection via X-Frame-Options: SAMEORIGIN header
  • ✓MIME type sniffing prevented via X-Content-Type-Options: nosniff
  • ✓All user input sanitized and parameterized to prevent SQL injection
  • ✓Server Actions use CSRF-safe patterns via Next.js App Router
  • ✓API routes validate authentication on every request
  • ✓Admin routes protected by additional role verification

Data privacy and breach response

  • ✓Data stored in the United States across all providers
  • ✓No personal data sold to third parties — ever
  • ✓Florida residents notified within 30 days of a discovered breach (FIPA)
  • ✓Georgia residents notified without unreasonable delay (O.C.G.A. § 10-1-912)
  • ✓Data deletion is permanent and irreversible upon account closure (90-day window)
  • ✓Billing records retained 7 years per tax law; all other data deleted on request

Responsible disclosure

If you discover a security vulnerability in ACCESS, please report it to us responsibly before public disclosure. We take all security reports seriously and will respond within 72 hours.

Email: support@jdwhite.world with the subject line "Security Report". Please include a description of the vulnerability, steps to reproduce, and potential impact.