Security & Data Handling

The application runs on Vercel. All persistent data - portfolios, loans, borrower financials, covenant data, documents - lives in Supabase (managed PostgreSQL and object storage) in the AWS eu-west-1 region (Ireland). Data does not leave the EU region at rest. Traffic is TLS-encrypted in transit; storage is encrypted at rest by the hosting provider.

The full register, with locations and transfer safeguards, is published at /subprocessors. In short:

• Vercel - application hosting and edge network.
• Supabase - database and document storage (AWS eu-west-1).
• Upstash - rate limiting (request metadata only, no deal data).
• Google (Gemini) - powers the optional data-room Q&A and document translation features. Document content is sent only when an authorised user explicitly invokes those features on a file; covenant and borrower reporting data is never sent, and portfolios in GCC jurisdictions are excluded altogether unless an in-region deployment is configured (data-residency gate in code).

Every security incident goes into an internal register, notifiable or not. The register derives the regulatory clocks from the moment we became aware: 72 hours to the supervisory authority under GDPR, UK GDPR and the Saudi PDPL where people are at risk, 24 hours to the selling institutions whose borrower data we process, and the DORA and NIS2 timelines where an incident is classified under them. The runbook is published in the repository (docs/gdpr/breach-response.md).

Covenant monitoring data embeds a borrower's quarterly P&L, so it carries the platform's strictest gate: it is visible to the portfolio owner and platform administrators only. An approved NDA - which unlocks the loan tape, pricing and collateral for a buyer - deliberately does not unlock covenant data, and the existence of monitoring on a portfolio is itself hidden from non-owners. Monitoring-only portfolios never appear on the marketplace at all.

Accounts are institutional and individually approved. TOTP two-factor authentication is available on every account; sessions can be revoked centrally. API tokens are scoped and read-only by design - there is no write scope to leak.

Every mutation of deal, covenant and borrower data writes an append-only audit record, with per-field before/after diffs on sensitive rows. Each day of the audit trail is sealed with a SHA-256 digest chained to the previous day; administrators can recompute and verify the chain on demand, so a changed, inserted or deleted row inside a sealed day is detectable. Covenant test history is persisted as it was concluded on the day - re-imports never silently rewrite past observations, and waivers, amendments and cures live in an append-only event log.

Deal data uses soft deletion so audit trails survive ordinary edits. On contract exit or a verified deletion request, we delete the account's data from production systems; GDPR/PDPL data-subject request tooling is built into the platform, including an open request form for people without an account. A nightly sweep enforces the published retention periods. Backups age out on the hosting provider's standard retention cycle.

Performance analytics load only after opt-in, and a browser sending the Global Privacy Control signal is treated as opted out without being asked. AI-generated content is labelled as such wherever it appears. Supply-chain checks (dependency audit, secret scanning, static analysis) run on every change before it can be merged.

bad.loans is not SOC 2 certified today, and we will not imply otherwise. The controls above are implemented in code and process; a formal audit engagement is a commercial-stage decision we expect to take with our first institutional design partners. If your diligence needs a specific control answered, ask us directly - a precise “not yet” beats a vague “compliant”.

Security questions, disclosure reports, and data-protection requests: b@bad.loans.