Trust Center

• Your data is yours

  You can export everything, anytime. We never sell, license, or share it with advertisers or AI training datasets.

• Each tenant is isolated

  Application queries are scoped to your tenant on the server, not just in the UI, and this scoping is covered by automated tests.

• Built locally, hosted globally

  Engineered in Conakry by 224 TECH. Hosted on established cloud providers (Vercel, Neon on AWS).

• Transparent by default

  We publish our sub-processor list and our breach notification commitment on this page.

• In transit - TLS for browser to server and server to database traffic.
• At rest - the primary database and file storage are encrypted at rest by our providers.
• Secrets - environment variables and signing keys are managed by Vercel's encrypted secret store; never committed to source.
• TOTP secrets - encrypted with AES-256-GCM in the database; the encryption key is held outside the database.

• Every row in every tenant-scoped table carries a `tenantId`.
• All server actions resolve the current tenant from the session - never from client input.
• Queries are scoped to the tenant before they reach the database, and automated tests check that one tenant cannot read another tenant's data.
• Photos and payment proofs sit in private object storage with cuid-based paths (effectively unguessable).

• Continuous backups of the primary database, managed by Neon.
• Point-in-time recovery within the retention window of our database plan.
• Backups are managed by the database provider, separately from the application.

• Production access is limited to a small set of 224 TECH engineers, each with their own credentials.
• Sensitive actions inside the application (such as data exports) are recorded in an audit log.
• Sessions for tenant users are server-validated and can be revoked instantly by admins.
• Multi-factor authentication available on all paid plans; required for ADMIN role on Enterprise.

If we discover unauthorized access to your data, we will notify the admins of every affected tenant within 72 hours of confirmation. Notification includes what happened, what data was affected, what we've done about it, and what you should do.

We use the smallest possible set of vendors. Every one is bound by a data-processing agreement.

You can request deletion at any time. Active tenant data is purged within 30 days of cancellation; copies in our database provider's backups expire at the end of its retention window. Before deletion we export your payslips and audit logs to you so you can meet any statutory retention obligation.

Service-level objectives are stated in your paid-plan subscription. Until we publish a public status page, we inform affected tenant admins of incidents by email.

Found a security issue? Email security@224tech.com. We acknowledge within 1 business day, triage within 5, and resolve critical issues within 30. We don't take legal action against good-faith researchers. Our full disclosure policy lives in the repository at SECURITY.md.

Security or compliance question? Write to privacy@224tech.com. We answer every message.