Security posture
Security, honestly.
Where we are right now: WithDave is not SOC 2 certified, and a formal audit has not begun. SOC 2 Type II is under consideration as we grow, and we build our security controls with that standard in mind. Rather than show a badge we don’t have — or promise a date we can’t stand behind — this page lays out exactly what we do and what we use.
What we use today
- Supabase Postgres with row-level security on every multi-tenant table. Each firm’s data is RLS-scoped to its
firm_id. - Encryption in transit (TLS 1.2+) and at rest (AES-256, via Supabase & Vercel storage).
- Stripe for all billing — we never store card numbers or full payment details.
- Anthropic Claude API for AI generation. Your data is never used to train any AI model — ours, Anthropic’s, or anyone else’s. Per Anthropic enterprise terms, your prompts and responses stay yours.
- Auth via Supabase Auth with magic links and email/password support.
- Append-only audit log per firm for every significant action (review approvals, document generation, team changes).
- Vercel for hosting, with HTTPS-only and automatic security headers.
What we don’t have yet
- SOC 2 certification (no audit engaged; SOC 2 Type II is under consideration as we grow, and we build our controls with that standard in mind)
- HIPAA Business Associate Agreement (in scope for Medical Pack production launch — see HIPAA posture)
- Penetration test results (planned)
- ISO 27001 (not on near-term roadmap)
If your firm has security review requirements, email dave@withdave.ai and we’ll talk through what we have and what we can commit to on a timeline.
Last updated: August 2026. We’d rather lead with deep technical posture than compliance badges we haven’t earned yet.