Skip to content
RemitRightRemitRight

Security & Compliance

Your data security and privacy are our top priorities. We implement enterprise-grade security measures to protect your sensitive business information.

Data Encryption

All data transmitted to and from RemitRight is protected using industry-standard encryption protocols.

  • TLS 1.3 Encryption: All data in transit is encrypted using the latest Transport Layer Security protocol
  • AES-256 Encryption: Sensitive data at rest is encrypted using military-grade Advanced Encryption Standard
  • Managed Key Storage: Encryption keys and API credentials are held by our infrastructure providers, never in application code

Database Security

Your business data is completely isolated from other customers using advanced database security features.

  • Row-Level Security (RLS): Each customer's data is isolated at the database level, ensuring no cross-contamination between accounts
  • Automated Backups: Daily encrypted database backups managed by Supabase
  • Access Controls: Strict role-based access control (RBAC) limits data access to authorized personnel only

Authentication & Access

Multi-layered authentication ensures only authorized users can access your account.

  • Secure Password Hashing: Passwords are hashed using bcrypt with unique salts
  • Session Management: Secure session tokens with automatic expiration
  • Magic Link Authentication: Passwordless login option for enhanced security
  • Rate Limiting: Repeated failed sign-in attempts are throttled by Supabase Auth

Infrastructure & Hosting

We partner with industry-leading cloud providers to ensure maximum security and reliability.

  • Supabase Infrastructure: Built on PostgreSQL with enterprise-grade security features
  • DDoS Protection: Edge-level protection against distributed denial-of-service attacks, provided by our hosting layer

Regulatory Obligations

RemitRight does not hold security certifications of its own. Below is what we are built to do, and which certifications belong to the providers underneath us.

🇨🇦 PIPEDA

Personal information is collected only to collect the invoice it relates to, and is not sold or shared with other businesses on the platform

📧 CASL

Messages identify the sender and carry a one-word opt-out. A customer who replies STOP is removed from further messages on that invoice

💳 PCI DSS

Card details are entered with Stripe, a PCI DSS Level 1 certified provider, and never reach RemitRight's servers

🔐 SOC 2 Type II

Held by our infrastructure providers for the platforms we run on, not by RemitRight itself

Trusted Third-Party Partners

We only work with industry-leading security-certified partners:

Stripe

PCI-compliant payment processing

Twilio

Secure SMS delivery infrastructure

Supabase

Enterprise-grade database hosting

Report Security Concerns

RemitRight is a small Canadian team, and we would rather hear about a problem than discover it later. If you find a vulnerability, please report it responsibly:

Security Contact

Email: welcome@remitright.ca

Reports go straight to the people who build the platform, and we will keep you updated on what we do about it.