Security & Trust

Every request to CheckSmith.ai is tied to an authenticated user. Sessions are signed, short-lived, and revocable.

• Email + password and Google sign-in, brokered through our identity provider.
• Sessions are short-lived JSON Web Tokens; signing out clears cached data.
• Role-based access: owner, admin, accountant, and member — enforced per workspace.
• Admin actions are recorded in an audit log retained for at least one year.

Every customer-owned table is scoped to a workspace. The database rejects cross-workspace reads and writes, so one company can never see another company's data.

• Row-level security policies enforced at the database, not just the app.
• Membership checked on every query through a security-definer helper.
• Shareable links (proposals, IRA snapshots) use unguessable tokens with narrow, read-only access.

Data is encrypted in transit and at rest using standard algorithms provided by our managed cloud platform.

• TLS 1.2+ for every browser and API request.
• Database and file storage encryption at rest using the platform's default algorithms.
• Secrets are stored in an encrypted secret manager and are only read by the application at runtime.

We store the data you enter into CheckSmith.ai and the minimum operational data needed to run the service.

• Business records you create: invoices, clients, ledger entries, bank reconciliation data, payroll runs and paycheck records, checks, IRA holdings, and uploaded documents.
• Account data: email, name, workspace membership, and role.
• Operational data: sign-in timestamps, admin audit events, and error diagnostics.
• We do not sell customer data and do not use it to train third-party AI models.

CheckSmith.ai runs on Lovable Cloud managed infrastructure. We disclose the subprocessors that store or process customer data so you can review them.

• Application and database hosted on Lovable Cloud.
• Optional bank data via Plaid — only for workspaces that link an account.
• Transactional email delivered through Lovable's managed email infrastructure.
• AI features via Lovable AI Gateway; prompt content is not used to train the underlying models.
• Payment processing through a third-party payment processor when online payments are enabled.

We use a small number of cookies and analytics tools to keep sessions secure and understand how the product is used.

• Session cookies are required for authentication and security.
• First-party analytics beacon records pageviews and feature usage to improve the service.
• Third-party analytics (Google Analytics 4, Plausible) are loaded only when configured for the workspace.
• You can disable third-party analytics in your browser or through your workspace settings where available.

You control your data. Deleted records leave the live database immediately; backups age out on a fixed schedule.

• Workspace deletion removes your data from the live database right away.
• Encrypted backups roll off within 35 days of deletion.
• Admin audit log entries are retained for one year and then archived or purged.
• Export your data at any time from Settings → Export.

We do not store card numbers. When online payments are enabled, card data is handled by the payment processor's hosted fields.

• Card data is entered directly into the payment processor's secure iframe or hosted page.
• CheckSmith.ai only receives a tokenized customer and subscription reference.

We describe the controls we have in place. We do not claim certifications we have not earned.

• CheckSmith.ai is not yet SOC 2, ISO 27001, HIPAA, or PCI-DSS certified.
• We are not a HIPAA business associate and do not sign business-associate agreements today.
• For enterprise procurement questions, contact us and we will share what we can document.

If we confirm a security incident that affects customer data, we notify affected workspace owners without undue delay.

• Owners are notified by email at the address on file.
• Notice includes what we know, what we're doing, and what you should do.