Security & data handling
Built to be trusted with the ledger.
The questions a controller asks before handing over the books — who can see the data, what gets recorded, and whether anyone can touch the money — answered in the architecture, not a badge.
Controls in the product
What's enforced, in code, today.
Tenant isolation
Row-level security on every customer-data table. Your data is walled off at the database layer and scoped to your organization on every request.
Append-only audit trail
Every action lands in an immutable log — the database itself rejects edits and deletes. Corrections are counter-entries, never rewrites.
Encrypted in transit and at rest
TLS on every connection; encryption at rest on the database. Secrets live in environment configuration — never in code, never in logs.
Authorization on every route
Being signed in is never enough. Every route re-verifies that you own the specific resource it returns before returning it.
No fund custody
The Pay-Now checkout runs in your own Stripe account. RevRec moves the data, never the money — nothing settles through us.
Signed webhooks only
Every inbound webhook proves its cryptographic signature before the payload is trusted. Unsigned or mis-signed calls are rejected.
Constant-time secrets
Token and signature comparisons use timing-safe equality, so a comparison can't leak information about the secret it checks.
Human approval gates
Nothing posts to your general ledger without the required review — and sample contracts can never post at all.
Validated input
Every request body and parameter is schema-validated before use. Malformed input is rejected, not repaired.
Where we are on SOC 2
No badge-wall. Here’s the posture.
RevRec Engine is not yet SOC 2 certified, and we won’t pretend otherwise. The engineering baseline tracks the Trust Services Criteria commit by commit — the controls above are enforced in code and covered by tests today, not promised for later.
If your vendor-review process needs the detail — data flows, subprocessors, control descriptions — ask, and we’ll walk you through exactly what’s built.
Evaluate it without connecting anything.
Sample contracts and a no-GL evaluation path let you see the whole loop before any of your data moves.