Security and data ownership at Korrit

Korrit holds a lot of what runs your firm: projects, hours, invoices, pay rates and bank activity. This page explains where that data is stored, who at your firm can see it, which outside services touch it, and how to get all of it back whenever you want.

Where your data lives

Your firm’s records live in a Postgres database hosted by Supabase. Supabase is SOC 2 Type II audited and states that all customer data is encrypted at rest with AES-256 and in transit with TLS.

The Korrit app at dash.korrit.app and the API behind it run on Cloudflare, which also handles caching and the connection to the database. Profile photos are stored in Cloudflare’s file storage. Cloudflare holds a SOC 2 Type II report covering security, confidentiality and availability, and is certified to ISO 27001, ISO 27018 and ISO 27701. Its network detects and absorbs denial-of-service attacks automatically, before that traffic reaches Korrit. It’s one of the largest networks on the internet: W3Techs counts Cloudflare on 27.8% of all websites (October 2026), and Cloudflare handles an average of 115 million web requests every second. That scale is part of the protection, because attacks seen anywhere on its network inform the defenses in front of every site it serves.

Your browser never talks to the database directly. Every request goes through Korrit’s API, which checks who you are and what your role allows before it reads or writes anything. The database’s public access route is shut: every table is set to refuse outside requests, so the API is the only way in.

Who can see it

Signing in

You sign in with your email and password, with Google, or with a one-time link sent to your email. Supabase handles sign-in. Korrit’s API checks the signed sign-in token on every request and refuses anything expired or tampered with.

Your firm’s data stays with your firm

Every record in Korrit belongs to one firm. Each request names the firm you’re working in, Korrit confirms you’re a member of it, and every query is limited to that firm’s records. If you belong to more than one firm, you switch between them; their data never mixes.

Roles

Inside your firm, each person has a role, and the role decides what they can see and change. Anything a role isn’t given is refused.

Role	What they can see
Principal	Everything in the firm, including pay rates and bank details
Finance	Clients, invoices, finances and compensation across the firm. Can’t change project work
Project manager	Clients and contacts, plus the projects they’re assigned to, their invoices (read only) and the timesheet approvals for them
Designer	Clients and contacts, assigned projects and tasks, and their own time
Drafter	Clients and contacts, assigned projects and tasks, and their own time. No client financials
Contractor	Only their assigned projects and their own time

Pay rates, bank details and tax IDs are a separate permission. Seeing a team member’s record doesn’t mean seeing their pay. Out of the box, only Principal and Finance hold that permission. To see exactly what each role can do, open Team → Roles & permissions.

Korrit also keeps a running record of changes: what was created, edited, deleted, approved, sent or paid, and by whom.

Encryption

• In transit. Everything between your browser and Korrit travels over HTTPS. The connection from Korrit to the database is encrypted too.
• At rest. Supabase encrypts the whole database with AES-256.
• An extra layer for the most sensitive values. Korrit encrypts certain fields itself before they’re saved, with AES-256-GCM. That covers the connection keys for QuickBooks, Gusto and your bank connections, the bank account and routing numbers you add for invoice payments, and your Stripe account ID. The encryption key is kept in Cloudflare’s secret storage, separate from the database. For bank numbers, the app only ever shows the last four digits.
• AI connection tokens are stored as a one-way fingerprint, so even Korrit can’t read them back.

The services we rely on

Korrit uses a small number of outside services. Here is each one and what it handles.

Service	What it does in Korrit	What data it handles	Security page
Supabase	Database and sign-in	All your Korrit records and your sign-in details	supabase.com/security
Cloudflare	Runs the app and API, caching, profile photo storage, denial-of-service protection	Every request passes through it; profile photos	cloudflare.com/trust-hub
Intuit QuickBooks	Two-way accounting sync, if you connect it	Clients, invoices, payments and credits	security.intuit.com
Plaid	Bank connections, if you connect them	Account names, balances and transactions. Your bank login goes to Plaid, never to Korrit	plaid.com/safety
Stripe	Online invoice payments by bank (ACH debit or bank transfer), and your Korrit subscription	Your clients’ bank payment details stay with Stripe. Korrit receives the payment status	docs.stripe.com/security
Gusto	Payroll, if you use it	Team members, approved hours and pay. Your payroll tax registrations and bank account live in Gusto	gusto.com/security
Resend	Sends Korrit’s emails, such as invites and invoices	Recipient addresses and the email contents, including invoice PDFs	resend.com/security
TypeSafe AI (Jev)	Suggests matches for clients with similar names during a QuickBooks import	The names, emails and postal codes of the clients being matched, only while an import runs	typesafe.ai
OpenAI	Writes the wording of your quarterly recap	Firm-wide totals only. No client, project or person names are sent	trust.openai.com

For how the QuickBooks connection decides what moves in each direction, see How QuickBooks sync works.

Your data is yours

You can have all of your firm’s data at any time. Email [email protected] and ask for an export. You’ll get everything, so you can open it in a spreadsheet or your own reporting tools and explore it however you like.

If you leave Korrit, your workspace locks when your subscription ends, but your data isn’t deleted. You can still ask for your export afterwards. Questions about removing your firm’s data go to the same address.

The AI connection

You can connect Korrit to Claude or ChatGPT so you can ask questions about your firm in plain English. Each connection belongs to the person who created it and acts with exactly that person’s role. If you can’t see pay rates in Korrit, neither can the assistant you connected. You can see and revoke your own connections at any time. What Claude and ChatGPT can see and do in Korrit covers the details.

Reporting a security issue

If you think you’ve found a security problem in Korrit, email [email protected] with what you found and the steps to reproduce it. Please don’t test against other firms’ data or share the issue publicly until it’s fixed. Yuri reads these himself.