Security & privacy

Your data is the deal. We treat it that way.

Cashifi is built on the same security primitives banks use. Encryption at every hop, least-privilege access, soft credit pulls, and a strict no-sale data policy. Here's exactly what that means.

Our security pillars

What we promise, in plain English.

Encrypted, end to end

All data in transit uses TLS 1.2+. All data at rest is encrypted with AES-256. Database backups, file uploads, and event logs share the same envelope.

Least-privilege access

Only the systems that need a piece of data can see it. Staff access is role-scoped (super-admin / admin / agent); customers see only their own application. Service-role keys never reach the browser.

Soft pulls only

Checking eligibility uses a soft credit inquiry — no impact to your score. A hard pull only happens after you accept a specific offer and explicitly authorize the lender.

We don't sell data

Your information is shared only with the lenders we match you to, and only after you advance them. We don't sell, rent, or trade contact data with marketing networks.

Audit trail by default

Every staff action on your application — status change, document review, lender submission — is logged with the actor and timestamp. Your portal mirrors this so nothing is hidden.

How it works

The detail, for the people who ask.

Infrastructure

Hosted on enterprise cloud platforms (Vercel + Supabase). Postgres at rest is AES-256 encrypted; Vercel edge + CDN serve over TLS 1.2+.

Authentication

Email magic-links by default. Optional SSO for enterprise partners. Session tokens use httpOnly secure cookies; staff sessions auto-refresh with rotation.

Document handling

Uploads stream directly into private storage buckets via signed URLs — files are never proxied through our app servers. Bank-statement files are auto-expired after underwriting completes.

Logging & monitoring

Application + database logs are centralized with anomaly alerting. Authentication events, role escalations, and bulk reads page on-call within minutes.

Vendor management

Every subprocessor that handles customer data is vetted for their security posture. The current list is available on request — email us at any time.

Vulnerability disclosure

Responsible disclosure is encouraged. Email findings to our security contact below; we'll acknowledge within 1 business day and publish a fix on a coordinated date.

Reporting a vulnerability or asking a hard question

We respond to security and privacy inquiries within one business day. Lender procurement teams: a subprocessor list and security questionnaire response are available on request.

Email help@cashifi.com