Designed around limited data and traceable access
Solvren needs metadata, contract terms, and cost evidence to calculate margin. It rejects prompt text, response text, document content, and payment-card data from the ingestion schema.
Access
Verified work-email accounts, role-based organization access, and MFA for Owner, Finance, and Engineer roles. Cross-organization records are separated by database policies and server authorization.
Secrets and exports
Connector credentials are encrypted in Supabase Vault and not returned to the browser after entry. Disconnect removes the credential. Private report downloads require organization access and use expiring signed links.
Operations
Imports and connector syncs are checkpointed and retryable. Source gaps and stale data stay visible. Normalized events have a 13-month default retention period; account closure schedules deletion of primary records and private files.
What we do not claim
Solvren does not claim SOC 2, ISO 27001, HIPAA compliance, a completed independent audit, or a measured uptime guarantee. We do not currently offer a contractual recovery-time or data-loss guarantee. Organization Owners can export their data. Data residency depends on the configured production services and should be confirmed in a customer agreement.
Report a security concern through the security support route. We track it as a case and publish incident updates on the status page.