Security you can trust
Your financial data deserves the highest level of protection. Summit Spend is built with security at every layer — from encryption and access controls to multi-factor authentication and audit logging.
Encryption at Rest & In Transit
Traffic to Summit Spend uses TLS 1.2 or newer. Data is encrypted at rest with AES-256 by our database and storage providers, and integration credentials are additionally encrypted with a key held in a secrets vault.
Bank-Grade Financial Security
Bank connections are handled by Plaid, which maintains SOC 2 Type II compliance and uses bank-level encryption. Your bank credentials are never stored by Summit Spend — they're held exclusively by Plaid.
Role-Based Access Control
Granular RBAC with three built-in roles (Admin, Manager, Member) and support for custom roles with fine-grained permissions. Administrators control exactly who can view, edit, approve, and export data.
Audit Logging
Changes to transactions, receipts, expense reports, approvals, vendors, and coding rules are recorded in an audit log showing who changed what and when. Entries can't be edited or deleted individually, and the log is searchable and exportable to CSV.
Infrastructure Security
Hosted on AWS, with Supabase Postgres for the database and Stytch for sign-in, all in US regions. Those providers are SOC 2 audited; Summit Spend itself does not have a SOC 2 report yet. Production secrets live in an encrypted parameter store, never in source code.
Secure Integrations
Sage Intacct and QuickBooks Online (beta) connect with OAuth 2.0, and Plaid links banks through its own secure flow. The tokens these connections issue are stored encrypted, and we never see your bank password.
Security practices
Multi-Factor Authentication
Authenticator-app (TOTP) MFA is available to every user, and admins can require it for their whole organization
Session Management
Short-lived signed session tokens, verified on every request and renewed automatically while you work
Row-Level Security
Database-level tenant isolation ensures organizations can never access each other's data
Input Validation
Request data is checked on the server before it is written, and the database enforces its own column types and constraints
Staff Access Controls
Summit Spend staff sign in to internal tools with mandatory MFA, and internal-tool sessions end after 12 hours
Least-Privilege Defaults
New members join with the Member role, the most limited built-in role, unless an admin assigns another
Data residency & retention
Data hosted in US regions on AWS
Financial record retention for regulatory compliance
Data export window after account termination
Questions about security?
Our team is happy to discuss our security practices in detail.