Security posture
Security, honestly.
Where we are right now: WithDave is not yet SOC 2 certified, but the audit has a date. We’re beginning our SOC 2 Type II audit in Q3 2026; certification is expected by Q4 2026. Rather than show a badge we don’t have, this page lays out exactly what we do, what we use, and the timeline we’re committing to.
What we use today
- Supabase Postgres with row-level security on every multi-tenant table. Each firm’s data is RLS-scoped to its
firm_id. - Encryption in transit (TLS 1.2+) and at rest (AES-256, via Supabase & Vercel storage).
- Stripe for all billing — we never store card numbers or full payment details.
- Anthropic Claude API for AI generation. Your data is never used to train any AI model — ours, Anthropic’s, or anyone else’s. Per Anthropic enterprise terms, your prompts and responses stay yours.
- Auth via Supabase Auth with magic links and email/password support.
- Append-only audit log per firm for every significant action (review approvals, document generation, team changes).
- Vercel for hosting, with HTTPS-only and automatic security headers.
What we don’t have yet
- SOC 2 Type II audit (begins Q3 2026 — certification expected Q4 2026)
- HIPAA Business Associate Agreement (in scope for Medical Pack production launch — see HIPAA posture)
- Penetration test results (planned)
- ISO 27001 (not on near-term roadmap)
If your firm has security review requirements, email dave@withdave.ai and we’ll talk through what we have and what we can commit to on a timeline.
Last updated: April 2026. We’d rather lead with deep technical posture than compliance badges we haven’t earned yet.