Early access · Security
We're early. Here's exactly what that means for your client data.
We don't have a SOC 2 report yet. Rather than dress that up, we're trading the badge for something more useful while we're small: the full detail of how the system is built, and a named person who answers for it. This is a deliberate choice about how we want to be trusted — not an excuse we're waiting to grow out of.
What we have today
- Row-level security on every table, scoping each record to a single firm at the database layer.
- Encryption in transit (TLS 1.2+) and at rest, through our managed database and hosting providers.
- Role-based access control — owner, admin, consultant, analyst, finance and client viewer — with roles held in a separate table and checked server-side.
- An activity log recording who changed what, readable by owners, admins and finance.
- Client portal access by scoped, revocable link rather than a shared login, validated server-side on every read.
- No third-party analytics, advertising or session-recording scripts anywhere in the product.
What we don't have yet
- No SOC 2 report — not Type I, not Type II.
- No independent penetration test report.
- No contractual uptime SLA.
- No BAA, so the product is not appropriate for protected health information.
- No single-tenant or self-hosted deployment option.
- No customer-managed encryption keys.
What you get instead
- Direct access to the founder for any security question, before or after you buy.
- A written security summary on request, covering the points on this page in more depth.
- Full export of everything your firm owns, at any time, in an open format.
- Account deletion on request, with no minimum retention period held over you.
How your data is handled
Engagements, documents, time entries, invoices and your knowledge library live in a managed PostgreSQL database provided by Supabase, running on AWS infrastructure. Every row carries the identifying firm, and every table has row-level security enabled: a query issued by one firm's session cannot return another firm's records, regardless of what the application asks for. The isolation is enforced by the database, not by our UI code.
Roles are stored in a separate table and evaluated by security-definer functions inside the database, so a user cannot grant themselves a role by editing their own profile.
A client portal session is issued against exactly one engagement. It can only ever read that engagement, and it is validated on the server for every single read. It cannot reach rate cards, costs, margins, time entries, expenses, internal notes, other engagements for the same client, or any other firm — those tables are not projected into the portal at all.
The visibility model is closed by default. Deliverables, milestones, meetings, invoices and messages are created hidden, and become client-visible only when someone at your firm deliberately marks them so. Nothing reaches a client because it was forgotten about. We treat that default as a security property, not a convenience.
AI and your content
Drafting requests are sent through the Lovable AI Gateway to Google's Gemini models. Your content is used to produce that one response and is not used to train any model.
The mechanism, rather than just the promise: prompts are assembled server-side from your own firm's records only — the grounding context is selected by the same firm-scoped queries the rest of the app uses, so one firm's case studies, methodologies or brand voice can never be retrieved into another firm's generation. We store a per-firm count of generations for plan limits; we do not store the prompt or the model's response beyond the document you save.
If our AI provider's terms ever change in a way that affects how your content is handled, we will say so in the changelog before the change takes effect.
Where we're going
01
SOC 2 Type I
The next milestone. Controls documented and independently examined at a point in time.
02
Independent penetration test
Run alongside the Type I work, with a summary report made available to customers.
03
SOC 2 Type II
The observation-period report that actually demonstrates the controls hold over time.
No dates. We would rather commit to the order than to a date we might miss.
Who's accountable
Security questions go to James F. Kollie, Jr. directly — support@consultsuitepro.com.
That is one monitored inbox rather than a specialist alias nobody watches — it reaches a named person, not a ticket queue. If you're evaluating us on behalf of a client with a serious confidentiality obligation, ask whatever you need to ask.
Security researchers: if you find something, please report it to the same address. We commit to acknowledging every report within two business days, and we won't pursue anyone acting in good faith.
Your rights
Export. From Settings → Data & privacy, any firm can download everything it owns — clients, engagements, deliverables, documents, proposals, invoices, time, expenses, meetings, decisions, action items, research, content and contracts — as one machine-readable JSON archive. On every plan, at any time, including after cancelling.
Deletion. You can request deletion of your firm and its data. We confirm the request with the firm owner before acting, then remove it; there is no minimum retention period, beyond billing records we're legally required to keep.
Sub-processors
Read all of that and still want to try it?
That's the kind of customer we're building for right now.
Start your 14-day trial