Trust & security at The Connect.
The Connect serves governments, development banks, and regulated institutions. This page describes the security controls that ship today, how we handle data, our honest compliance posture, and how to reach us about a vulnerability. We state what is in place exactly — a control that is only planned is never presented as if it were operating.
Security controls
Defense-in-depth across identity, authorization, encryption, and operational access.
Authentication & MFA
Email/password with secure, HTTP-only session cookies, plus enterprise SSO (SAML / OIDC) for institutional domains. Time-based one-time-password (TOTP) two-factor authentication is available on all accounts.
Authorization & row-level security
PostgreSQL row-level security enforces, at the database layer, that each account can read only its own data. Platform intelligence is gated to authenticated subscribers, and authorization is checked on the server for every request — not just in the interface.
Encryption in transit & at rest
All traffic is served over HTTPS (TLS 1.2+) with HSTS. Data at rest is encrypted by our managed database and hosting providers. No customer data is transmitted or stored in clear text.
Least-privilege service roles
Administrative and service-role operations are isolated from user sessions. Background jobs and integrations run with scoped credentials that hold only the access they need, so a compromise of one component does not grant broad data access.
Secrets management
API keys and credentials live in the hosting platform's encrypted secret store and are read from the environment at runtime — never committed to source control. Secrets can be rotated without code changes.
Tamper-evident audit trail
Logged actions are committed to a SHA-256 hash chain: each record links to the previous one, so any alteration, deletion, or reordering is cryptographically detectable and independently verifiable on demand.
Data handling & privacy
We process account details (name, email, organisation, role), subscription and billing data (handled by Stripe — we do not store full card numbers), and usage data such as searches, saved notices, and alerts. Procurement and awards intelligence is drawn from public and licensed sources; provenance is retained so a record can be traced back to its origin. Data is kept for as long as an account is active and as needed to provide the service and meet legal obligations; a Data Processing Agreement is available for institutional customers.
Compliance posture
SOC 2 Type II is a readiness effort in progress. We have mapped the AICPA Trust Services Criteria to controls that ship in the platform today and have implemented the technical controls described on this page. A third-party SOC 2 Type II examination has not yet been completed, and we do not claim to be SOC 2 certified or compliant. We also make no claim to ISO 27001, PCI DSS, HIPAA, or FedRAMP authorization. Where a formal attestation is not yet in place, we describe the concrete control that exists rather than a badge, and we are glad to walk institutional customers through our current readiness documentation under NDA.
Subprocessors
We rely on a small set of established infrastructure providers that process data on our instructions under a data-processing agreement. Each is listed with its role.
Vercel
Application hosting and global content delivery for the platform.
Supabase
Managed PostgreSQL database and authentication, including row-level security enforcement.
Stripe
Subscription billing and payment processing. We do not store full card numbers.
Resend
Transactional email delivery (alerts and digests) when email notifications are enabled.
The authoritative, maintained list is our Sub-processors page.
Responsible disclosure
We welcome reports from security researchers. If you believe you have found a vulnerability, email security@connect.thecefa.org. Please give us a reasonable window to investigate and remediate before any public disclosure. Our machine-readable policy is published at /.well-known/security.txt, which sets out the reporting contact, scope, and safe-harbor terms in full.