Browser envelope encryption
A fresh AES-256-GCM key protects each upload before Supabase receives it. The data key is wrapped with DealFlo's current RSA public key.
Security & privacy
Private by design.
Precise about the boundary.
DealFlo is built for investment information that should never become an ad profile, a training set, or an accidental public record. We publish what is protected, who can process plaintext, and what no architecture can honestly promise.
Architecture statement · updated September 2, 2026Technical controls
Application-layer encryption
Investment mandates, analyses, questions, answers, notes, pitches, citations, and deal names are encrypted before durable database writes.
Auth + RLS + relational ownership
Supabase row-level security is backed by owner-scoped server queries and composite foreign keys that prevent cross-user record references.
Minimum data, no autonomous access
The model receives only the material needed for the requested analysis. It has no database credentials, storage credentials, payment access, or general-purpose action tools.
The honest encryption boundary
Encrypted to the processor.
Not end-to-end encrypted during AI analysis.
Supabase stores encrypted document bytes. A DealFlo server function on Vercel unwraps and decrypts a document only to perform the analysis the user requested, then sends the required plaintext to OpenAI over TLS. OpenAI necessarily processes that plaintext during inference.
Calling this workflow “true E2EE” would be misleading: true E2EE would prevent both DealFlo and OpenAI from reading the content and would require local inference or a separately attested confidential-computing design.
Data promises
- We do not sell customer data or build advertising profiles.
- We do not train or fine-tune DealFlo or third-party models on customer content.
- We do not enable optional API data sharing for customer prompts or outputs.
- Public analytics are off by default and never run inside the signed-in workspace.
- External web research is off by default and must be enabled deliberately.
OpenAI API handling
No model training by default is not the same as zero retention.
Every DealFlo Responses API request sets store: false. OpenAI states that API data is not used to train its models unless a customer explicitly opts in. Under standard controls, abuse-monitoring logs may still retain customer content for up to 30 days. DealFlo will only claim Zero Data Retention after OpenAI approves and enables it for the production project.
Prompt-injection containment
Untrusted documents cannot receive authority.
Documents and webpages are explicitly treated as data beneath developer instructions. Outputs must pass strict schemas, evidence IDs are allowlisted, deterministic calculations override generated arithmetic, URLs must use HTTPS, and the model has no privileged action tools. No provider can promise that prompt injection is impossible, so the system is designed to contain failure rather than trust model obedience alone.
Data lifecycle
Upload
The browser encrypts each file. Supabase receives opaque ciphertext at a randomized storage path.
Analyze
Vercel decrypts transiently and sends only the requested material. OpenAI application storage is disabled.
Keep
Durable analysis is encrypted at the application layer. Operational metadata remains available to run the service.
Delete
Deleting a deal removes its vault objects and cascading database records and attempts immediate cancellation and deletion of temporary OpenAI artifacts.