Security
Last updated August 17, 2026
AllinOS holds the record of your sales business: customers, quotes, signed contracts, and conversations. This page describes, in plain terms, how that data is protected. The design principle throughout: the most sensitive material (card numbers, email credentials) is held by specialist providers built for it, never by us.
Encryption in transit and at rest
Every connection to AllinOS is encrypted with TLS: browser to app, app to database, and app to every service provider. There are no unencrypted paths. Data at rest is encrypted with AES-256 at the infrastructure layer.
Authentication and access
Every request to the application requires an authenticated session. Passwords are hashed with an industry-standard algorithm and are never stored or logged in readable form. Privileged server credentials are never exposed to the browser. Signing out of a shared device also scrubs locally cached business data from it.
Access is role-based and enforced server-side: each sales professional sees only their own pipeline, and management views are restricted to authorized roles. These rules are applied at the API layer on every request, not in the browser.
Verified file integrity
Every document and photo written to storage is read back and byte-verified before the upload reports success, and an automated integrity audit re-checks recently stored files every night.
Payments
Subscription payments are processed by Stripe, a PCI DSS Level 1 certified processor. Card numbers are entered on Stripe's hosted pages and never touch our servers; we hold only your subscription status and the card's brand and last four digits. Because no card data ever touches our systems, AllinOS qualifies for PCI DSS SAQ A, the assessment scope for fully outsourced payment handling.
Email connectivity
Connecting an email account uses OAuth through Nylas: you authorize access with your email provider directly, and we never see or store your email password. The connection can be revoked at any time from your provider's account settings.
Documents and signatures
Quotes, contracts, and signed documents live in access-controlled storage and are served through short-lived signed links rather than public URLs. Customer-facing quote pages expose only what the sales professional chose to publish.
Independently audited infrastructure
AllinOS is built exclusively on providers that carry current, independent security attestations, verifiable at each provider's own trust page below. AI providers are used under commercial API terms that prohibit training on customer data.
| Provider | Role | Attestation |
|---|---|---|
| Supabase (on AWS) | Database and file storage | SOC 2 Type II |
| Vercel | Application hosting | SOC 2 Type II |
| Stripe | Payments | PCI DSS Level 1 |
| Anthropic | AI processing | SOC 2 Type II |
| Google Cloud | AI image processing | ISO 27001, SOC 2 |
| Nylas | Email connectivity | SOC 2 Type II |
| Telnyx | Voice and texting | SOC 2 Type II |
| Sentry | Error monitoring | SOC 2 Type II |
| Resend | Transactional email | SOC 2 Type II |
Backups and availability
The service runs on managed cloud infrastructure with automated daily database backups and 24/7 error monitoring. The app is offline-first in the field: work continues without a connection and syncs when connectivity returns, so a network or server interruption never stops a rep mid-appointment. Current and historical uptime is published on our public status page, independently monitored from outside our own infrastructure.
Data ownership and deletion
Your business records are yours. You can request a full export, and account deletion requests are completed within 30 days as described in the Privacy Policy. The service providers that process data on our behalf are listed there as well.
Shared responsibility
A few protections only you can provide: use a strong, unique password; protect the devices you run the app on with a passcode or biometrics; and sign out on shared hardware. Security is a partnership, and this is your side of it.
Security review
Evaluating AllinOS for your organization? Our completed security questionnaire (CAIQ v4.1, the Cloud Security Alliance's standard assessment) is published in the CSA's public STAR Registry, where it can be downloaded directly. Written security policies are available on request at spencer@kovarra.com, and we are glad to walk your security reviewer through the architecture directly.
Responsible disclosure
If you believe you have found a security issue, email spencer@kovarra.com or contact us at (656) 204-5672. We acknowledge reports within two business days, keep you informed while we investigate, and credit researchers who wish to be named once a fix ships.
We support good-faith security research: if you make a reasonable effort to avoid privacy violations, data destruction, and service disruption, and you do not access or retain customer data beyond what is needed to demonstrate the issue, we will not pursue legal action over your research. This information is also published in machine-readable form at /.well-known/security.txt.