Current controls and boundaries

Security & Data

Copper Ledge is designed for focused, founder-led work with explicit data boundaries and human authority. This is not a certification or a claim of perfect security.

Organization isolation

Canonical customer records are scoped to an organization. Protected access uses authentication, organization membership, role checks, and Supabase Row Level Security. Production tenant-isolation checks are part of customer release validation.

Data minimization

We ask for information only when it is relevant to the agreed Mission. Existing business systems remain systems of record. Sensitive or regulated data and direct system access require separate review, approval, and appropriate terms.

Files and lifecycle

Controlled pilots currently accept only approved text/CSV evidence under documented limits and handling rules. Authorized file deletion is supported; broader export and canonical-record deletion remain manual or require separate review. Customer-specific retention and offboarding terms are confirmed before intake.

Human authority and AI

Copper Ledge does not autonomously make consequential business decisions. Any enabled model assistance remains subordinate to current evidence, provenance, access controls, and human review. We do not claim SOC 2, HIPAA compliance, or a completed independent penetration test.