CanyonOps is built with security at its core. We protect your client data with industry-standard controls and are actively working toward SOC 2 certification.
ZIP containing 5 documents — security practices, SOC 2 assessment, DPA, and more
All data is scoped to your organization via row-level isolation. Every API request validates org membership — no cross-tenant data access is possible.
TLS for all data in transit (HTTPS, database connections, email). AES-256 encryption at rest for all database storage.
Four distinct roles (admin, advisor, staff, professional) with centralized permission enforcement on every API route.
All API inputs validated with Zod schemas. Parameterized SQL queries via Drizzle ORM prevent injection attacks. React JSX escaping prevents XSS.
Every create, update, and delete operation is logged with actor, timestamp, and before/after state. Audit logs are insert-only and cannot be modified.
API rate limits (120 req/min general, 5 req/min auth) plus Cloudflare Turnstile bot protection on authentication forms.
Target: Q1 2027 for SOC 2 Type I certification
Security baseline documentation, DPA template, security questionnaire
Formal policies (incident response, change management, data classification)
Penetration test, monitoring/alerting setup, vendor assessments
SOC 2 Type I audit engagement
SOC 2 Type I report — begin observation period for Type II
Third-party services that process data on behalf of CanyonOps.
| Provider | Purpose | Data Access | Location |
|---|---|---|---|
| Neon | Serverless PostgreSQL database | All application data | US (AWS us-east-1) |
| Vercel | Application hosting & blob storage | All data in transit, attachments at rest | United States |
| Resend | Transactional email delivery | Recipient emails, email content | United States |
| Cloudflare | Turnstile bot protection | IP addresses, browser metadata | Global |
Client household information (names, contact details, birth dates), financial account data (account names, types, balances), task management records, communication notes, and file attachments. No Social Security numbers, account numbers, or trade execution data.
Yes. All infrastructure components — database (Neon/AWS us-east-1), hosting (Vercel), and blob storage — are US-based.
Yes. All database queries include an organization_id filter. Every API route validates the session and extracts the org scope. There is no mechanism for one organization to access another's data.
Not yet. Our SOC 2 readiness assessment is complete and we are actively working toward SOC 2 Type I certification by Q1 2027. Download our security pack for the full readiness assessment.
Yes. A DPA template covering sub-processors, security measures, breach notification, and data subject rights is included in our downloadable security pack.
Includes security practices documentation, pre-filled security questionnaire, SOC 2 readiness assessment, DPA template, and data retention policy.