RESOLVEBuilt on row-level security, not a promise to be careful.
RESOLVE holds Social Security numbers, bank details, and full books of business — data that has to be protected by the database itself, not just by good intentions in the interface. Here’s specifically what that means today, without the certifications RESOLVE hasn’t earned yet.
HTTPS everywhere
Every connection to RESOLVE is encrypted in transit. The platform also sends a strict Content-Security-Policy and standard hardening headers (HSTS, X-Frame-Options, X-Content-Type-Options) on every response.
Authentication you don't have to trust us for
Sign-in is handled by Supabase Auth — RESOLVE never stores your password. Password reset uses a secure, time-limited link and never reveals whether an email address has an account.
Row-level security, enforced by the database
Access rules — who can read or write a given record — are enforced inside Postgres itself with row-level security, not just hidden in the interface. Bypassing the app entirely still hits the same rules.
Real isolation between agencies
Every business record is scoped to its owning agent and agency at the database layer. One agency's data is never reachable from another agency's session — this is a database-level boundary, not an application convention.
Field-level encryption for the most sensitive data
Social Security numbers, bank routing and account numbers, card numbers, and driver's license numbers are encrypted at the field level using pgcrypto with managed keys. Reading one back to plaintext requires an authorized call, and every reveal is logged with who accessed it and when.
Least privilege by default
An agent can read and write only their own book. An owner or manager can see their agency's data but can't edit another agent's records. Platform staff access is scoped to support purposes and logged the same way.
Established infrastructure, not self-hosted guesswork
RESOLVE runs on Vercel for application hosting and Supabase for the database and authentication — both built and audited for exactly this kind of workload, rather than a bespoke server RESOLVE maintains alone.
Found something? Tell us directly.
RESOLVE doesn't yet run a formal bug bounty program, but a responsibly disclosed security issue will always get a direct, fast response — see Contact below.
No SOC 2, ISO 27001, or HIPAA certification — yet.
RESOLVE has not completed a SOC 2 or ISO 27001 audit, is not HIPAA-certified, and has not commissioned a third-party penetration test. Rather than imply otherwise, this page describes exactly what’s actually implemented — the row-level security, field-level encryption, and access controls above are real and verifiable in how the platform is built, not marketing language layered on top of it. Found a real issue, or have a question that needs more detail than this page covers? Contact us directly.