Security, stated plainly

Is our data encrypted?

Yes, in transit and at rest. Every connection between the Underridge app, its servers and its providers uses HTTPS. Our database provider, Supabase, encrypts stored data at rest and states that it uses AES-256. Underridge does not add a separate layer of encryption inside the application.

Can another customer see our deals?

No. Each signed-in account can read only its own deals and account records, through row-level security in the database and server queries scoped to the signed-in user. The rule is kept in source control and checked with a cross-account isolation test. Workspaces are the exception by design: when accounts share a workspace, every member sees all of the others' full deals, including ones run before they joined. Today any member can create an invite code, which works for 30 days, and a member cannot leave a workspace on their own, so create or join a workspace only with people who should see every deal. Staff can remove a member only by disabling that user's access. Tighter workspace controls are planned.

How do users sign in? Is single sign-on available?

Users sign in through Supabase Auth with an email and password, an emailed sign-in link, or Google. Underridge does not offer enterprise single sign-on (SAML or Microsoft Entra) today. Access tokens refresh, and every protected request is checked against Supabase.

Do you use multi-factor authentication?

Not in the app yet. Underridge does not offer multi-factor authentication (MFA) to users or admins today; adding it is planned, required for admins and optional for users. For our own staff, the GitHub organization that holds Underridge's code requires two-factor authentication for every member.

Who at Greenridge can see our data?

A very small team. Admins are a named list, and admin screens show counts, not deal content. Staff who hold the database service key or access to the provider dashboards can read stored data. There is no written access list, access review or log of staff access yet; these are planned as part of a written security program. Secrets are kept only in the Cloudflare, Vercel and GitHub secret stores, not in source code, and preview deployments get none.

Does the AI model provider train on our data? Is zero data retention in place?

Underridge trains no models, and Anthropic's Commercial Terms bar Anthropic from training models on content sent through its API. Text from pilot accounts is also left out of Underridge's internal feedback review. Zero data retention is not in place. Anthropic's standard API retention applies: assume inputs and outputs may be kept for up to 30 days, content flagged by Anthropic's safety systems for up to 2 years, and safety classifier scores for up to 7 years. We plan to request zero data retention, which Anthropic grants at its discretion. Model inference is not pinned to the United States today.

Which subprocessors handle our data?

Deal data from bank pilot accounts goes to three subprocessors: Anthropic (the AI model), Supabase (database, sign-in and file storage) and Cloudflare (runs the app and API). Google handles sign-in for users who choose it, and an email service sends sign-in emails. For other accounts a few more services can be involved, such as GitHub for internal feedback review and an email delivery service for emails sent from the Desk. Stripe processes card payments and receives no deal data. Vercel hosts this website and its checkout. It receives no deal documents, but it holds the database service key used by the purchase webhook, which can read stored data. Updating our Privacy Policy to name them all is planned.

Where is our data stored and processed?

Stored data and files are with Supabase, in the AWS region chosen for our project; we have not yet confirmed which region. The app runs on Cloudflare's global network. Anthropic keeps data at rest in the United States, and model inference is not pinned to the United States today.

Does Underridge connect to our core or any other bank system?

No. Underridge is a standalone web app with no integration with core banking or any other bank system. Users choose the files they upload.

Do you have SOC 2, ISO 27001 or a penetration test?

No. Underridge has not been audited, holds no SOC 2 report or ISO 27001 certification, and has not had an independent penetration test. Its main subprocessors, Anthropic, Supabase and Cloudflare, state that they hold their own SOC 2 reports and ISO 27001 certifications. We have not yet decided the path or timing for an audit or a penetration test.

Do you carry cyber liability or E&O insurance?

Not today. Underridge has no cyber liability or errors and omissions (E&O) policy in force. Obtaining coverage is planned.

Do you offer an uptime SLA?

Not today. Underridge has no service level agreement or uptime commitment.

How would you tell us about an incident?

Incident notice terms for bank pilots, including how quickly we notify a bank of a service disruption or of any incident involving its data, are set in the pilot letter each bank signs; that letter is in counsel review. We do not yet have a written incident response plan; writing one is planned.

How do you monitor the service? Do you keep an audit log?

Service failures are logged in Cloudflare without document text, and a weekly operations digest is posted for staff. Real-time alerting to staff is being set up, and an outside uptime monitor is planned. Underridge has no audit log of sign-ins, data reads or deletions; only credit grants and take-backs record who acted, and no date is set for an audit log.

How long do you keep our data, and can you delete it?

Underridge is set to delete uploaded files when a run succeeds, and 30 days after a failed run last moved. Saved results, corrections and feedback are kept until they are deleted. At the end of a pilot, or on request, an admin tool deletes a user's or a bank's files, their rows in all 20 database tables and the sign-in identity, checks each step and produces a written confirmation. Copies in any database backups and at subprocessors, including Anthropic's standard API retention, are not removed by the tool and age out on those providers' schedules. For accounts outside a bank pilot, short feedback quotes in our internal GitHub review are also outside the tool. The tool passed an end to end test on a local copy of the service and has not yet been run in production. Any user can ask for deletion by emailing support@greenridgegroup.org from the account's address.

How do you remove a user's access?

One admin action disables the user's sign-in and revokes their API keys, AI assistant connector access, unused codes, workspace membership and pilot credits. A sign-in token already issued keeps working until it expires. Like the deletion tool, it passed an end to end test on a local copy of the service and has not yet been run in production.

What data may a bank use in a pilot?

Pilots are built for public deals, Underridge sample packages and synthetic files. Our pilot letter, in counsel review, bars borrower and customer personal information. For pilot accounts the product backs the rule: every account at a listed bank domain sees a notice of it, the Principals step asks for public or synthetic names only, and Desk email and saved contacts are turned off. Nothing scans uploads for personal information, and the API and AI assistant connector are not technically blocked for pilot accounts, so the rule depends on users following it.

How do you control changes to the product?

All code lives in a private GitHub repository. The main branch is protected: the automated CI check must pass, and force pushes and branch deletion are blocked, with no bypass. Server packages are pinned in a lockfile with integrity hashes, and every browser library is pinned to an exact version with an integrity hash. Every underwriting package records the engine version (prompt, contract and model) that produced it, and automated test traffic runs on a separate AI provider key with its own daily budget.

Which GitHub security settings are on?

Two-factor authentication is required for every member of our GitHub organization, and the main branch is protected: the CI check must pass, and force pushes and deletion are blocked. Automated secret and dependency scanning are not fully in place yet.

How are API keys and the web app protected?

API keys are stored only as SHA-256 hashes and can be revoked. The AI assistant connector signs in with OAuth and requires PKCE. App pages refuse to be framed by other sites and set nosniff, a referrer policy and a base-uri rule. A full content security policy runs in report-only mode, and enforcing it is in progress.

Do you have backups and a continuity plan?

Not fully. Database backups depend on our Supabase plan; we have not yet confirmed the plan, the backup schedule or how long backups are kept, and we have not tested a restore. Underridge has no written business continuity or disaster recovery plan and no recovery time or recovery point objective. The service depends on one AI model provider and a small team.

What happened in the October 19, 2026 outage?

From about 5:40 AM Central Time on October 19, 2026, every production underwrite failed because Greenridge's account with Anthropic reached its monthly spend limit. Failed runs were refunded, and nothing indicates any data was exposed. Spend-limit errors are now detected, refunded and logged, and automated test traffic runs on a separate key with its own daily budget. The production account still has a monthly spend limit, so the same failure can happen again until it is raised. If it does, runs fail and are refunded. Raising it is planned.

Who is responsible for security? Is there a written program?

Spencer Gareiss, Founder, Managing Partner & CEO, is accountable for security. There is no written information security program or formal risk assessment yet, and no policy for staff background checks or security training. A written program covering risk assessment, access reviews, onboarding and offboarding, business continuity and training is planned.

In progress

• Real-time alerts to staff when a service check fails.
• Enforcing the full content security policy, which runs in report-only mode today.

Planned

• A request to Anthropic to raise production model capacity.
• Multi-factor authentication in the app: required for admins, optional for users.
• Stronger controls on our code repository and provider accounts, including automated secret and dependency scanning and required code review before release.
• A request to Anthropic for zero data retention.
• Cyber liability and errors and omissions insurance.
• A written information security program, incident response plan and business continuity plan.
• Tighter workspace controls on who can invite, join and remove members.
• A first production run of the user removal and deletion tools, and a database restore test.
• Confirming provider settings: database plan, region and backup schedule, sign-in policies, TLS settings and log retention.
• An outside uptime monitor.
• A custody list and rotation procedure for the database service key.
• A Privacy Policy update that names every subprocessor.

Not yet decided

• The path and timing for a SOC 2 audit and an independent penetration test.
• Enterprise single sign-on.
• An audit log of sign-ins and data access.
• US-only model inference.
• Session and API key lifetime policies, and blocking the API and connector for bank pilot accounts.
• Code scanning.