1. Security model
AutoPermit is multi-tenant B2B software. Your workspace (organization) is the security boundary: jobs, uploads, ledger data, notifications, and audit history are tied to an organization ID and are not exposed across tenants.
- Server-side queries enforce organization scope on jobs, documents, and ledger operations
- Role-based permissions (owner, admin, member, viewer) gate sensitive actions
- Authentication is handled by Supabase Auth with session-based access to the application
2. Data classification
Customer permit operations data
Site addresses, permit numbers, AHJ names, client information, uploaded documents, extraction fields, status history, and submission artifacts. Treated as confidential business data.
Account data
Email, name, organization membership, billing metadata (via payment provider).
Operational telemetry
Error logs and performance data (e.g., Sentry when enabled)—scrubbed of secrets; used for reliability, not for advertising.
3. Infrastructure
- Application hosting: Vercel (edge/serverless delivery, HTTPS by default)
- Database: PostgreSQL via Supabase with connection pooling for application traffic
- File storage: Cloudinary for uploaded documents (access via secure URLs)
- Payments: Lemon Squeezy—card data is not stored on AutoPermit servers
Sub-processor details are listed in our Privacy Policy.
4. Encryption and network security
- TLS 1.2+ for data in transit between browsers, our servers, and integrated providers
- Secrets and API keys stored as environment variables, not in source code
- Webhook endpoints verified with shared secrets (e.g., billing provider signatures)
5. Application security practices
- Input validation on server actions and API routes (Zod schemas)
- Permission checks before ledger updates, imports, pack generation, and team changes
- Safe error messages to clients—no raw stack traces in production UI
- Audit log entries for job, ledger, document, and billing-related changes
- Readiness and status gates to reduce accidental "ready to submit" errors
6. Document and AI processing
Uploaded documents are sent to storage and, when you run extraction, to our AI provider for field suggestions. Extracted output is validated and must be reviewed in the app before affecting job fields or readiness. We do not treat your documents as public training data.
7. Access control for your team
Workspace owners can:
- Invite and remove members with role assignments
- Manage billing (owner-only on paid plans)
- Control who can edit jobs, manage the ledger, and generate submission packs
Remove access promptly when employees leave—credentials are tied to individual user accounts.
8. Backups and availability
Database hosting includes provider-managed backups. We recommend you export critical ledger data periodically via CSV. No system is immune to outage; monitor our status communications when published.
9. Responsible use of permit data
Customers are responsible for:
- Complying with AHJ and portal terms when recording status or portal checks
- Not using AutoPermit for unauthorized automated portal scraping
- Classifying and handling documents that contain personal or regulated information
AutoPermit is operational software—not a substitute for legal, engineering, or compliance sign-off on submissions.
10. Incident response
If we become aware of a security incident affecting Customer Data, we will investigate, mitigate, and notify affected workspace owners without undue delay when required by law or contract.
11. Vulnerability reports
We welcome responsible disclosure. Email hi@getautopermit.comwith a description, steps to reproduce, and impact. Do not access other customers' data. We will acknowledge receipt and work on remediation in good faith.
12. Compliance roadmap
We are building toward common B2B expectations (SOC 2–aligned controls, DPA on request for enterprise customers). Contact hi@getautopermit.com for security questionnaires or a Data Processing Agreement.