Security
Built for lender confidentiality. Honest about what we have.
AES-256 at rest. TLS 1.3 in transit. US-hosted on AWS. Row-level security on every table. Daily encrypted backups. Stripe handles card data — we never see it. Below: the specifics, plain. No SOC 2 claim because we don’t have one yet.
Questions? Email security@appraisalally.com — we acknowledge every report within one business day.
What we don’t claim
No SOC 2. No source-code escrow. Not yet.
Industry-standard certifications get added against signed evidence, not marketing copy. When SOC 2 is contracted with real dates, it ships back onto this page. Until then, this page is the honest specifics of controls we actually have — encryption, row-level security, OAuth-only third-party access, Stripe-handled card data, and daily backups.
Encryption
Every byte, encrypted. Coming and going.
Modern algorithms, modern key management, no half-measures.
AES-256 at rest
Every byte of customer data — appraisals, clients, invoices, comments, uploads — is encrypted on disk with AES-256. Keys are managed by AWS KMS and rotated on AWS's schedule. We never store unencrypted copies, anywhere.TLS 1.3 in transit
Every request between your browser, our app, and our database is wrapped in TLS 1.3 with modern cipher suites. HSTS is enforced. HTTP redirects to HTTPS. There is no unencrypted path.Password hashing
Passwords are hashed with bcrypt by Supabase Auth before they ever touch our database. We cannot see your password — not in logs, not in support tickets, not ever.
Hosting & residency
US-East AWS via Supabase.
Your data lives in AWS us-east-1, managed by Supabase. The application runs on Vercel's US edge. No international replicas. No cross-region backup copies. If you need a residency attestation for a client, email security@appraisalally.com and we’ll send one.
Application: Vercel (US edge)
Next.js on Vercel's US-hosted serverless and edge runtime. No European or Asia-Pacific routing.
Database: AWS us-east-1 via Supabase
Managed Postgres on AWS. Single primary region. Backups encrypted and stored in the same region.
File storage: Supabase Storage (S3-backed)
Workpaper uploads stored in Supabase Storage, backed by S3 in the same US region. Signed URLs only.
Defense in depth
Three layers that have to all fail.
- 1
Application-level scoping (the queries we write) filters by company on every request.
- 2
Row-level security policies in Postgres re-check the session's company on every read and write.
- 3
Service-role access is reserved for narrow, authenticated server actions (e.g. invitation acceptance) and audited in code review.
Row-level security
Postgres enforces tenant isolation, not just our code.
Every table that holds customer data is walled by row-level security — policies enforced by Postgres on every query, and tested on every deploy. Even if a query in our app accidentally forgot a where company_id = ? clause, the database refuses to return another business's rows. One company's data doesn't reach another's. RLS is the safety net under the app.
Role-based access
Who sees what, scoped to their job.
Four built-in roles plus custom roles on MAX. The Mine/All filter and assistant pairings limit access further.
Admin
Full access to company settings, billing, team management, and every appraisal. Typically the owner or office manager.
Appraiser
Full access to their own appraisals, calendar, and invoices. Can see the company kanban and assist on teammates' files when added.
Assistant
Sees only the appraisers they're paired with (or everyone, if unpaired). Same Mine/All filter scopes the dashboard, kanban, calendar, and invoices.
Custom roles (MAX)
Define per-permission roles for unusual office shapes — a bookkeeper who sees invoices but not appraisals, a trainee with view-only access, etc.
Payment data
Card data lives at Stripe. We never see it.
Card numbers, CVCs, and ACH details are entered into Stripe Elements — an iframe owned by Stripe — and tokenized before they touch any Appraisal Ally server. We store only the Stripe customer ID, the payment-method type (e.g. “Visa ending 4242”), and the resulting charge metadata.
- PCI-DSS compliance is inherited from Stripe (SAQ A).
- Stripe Connect Standard for payouts — Stripe holds funds in your account, not ours.
- Webhooks are signed and verified on every event.
What Appraisal Ally actually stores:
- · Stripe customer ID
- · Last 4 digits + brand of the saved card
- · Charge ID, amount, status, refund metadata
- · Allocation across invoices (your business data)
We do not store the full PAN, CVC, or any data that would let us replay a charge. That stays at Stripe.
Third-party integrations
OAuth only. We never see your passwords.
Google (Calendar, Drive, Gmail) and Dropbox connect via OAuth 2.0 today (Outlook / Microsoft 365 coming fall 2026). You grant scoped access from their consent screen — and revoke it the same way.
Google Calendar, Drive & Gmail
OAuth 2.0 with the minimum scopes for each feature: two-way calendar sync, assignment folders in the Drive location you designate, and send-only Gmail access used exclusively for documents you explicitly send from your own address (engagement letters, invoices, payout statements) — we can't read your mailbox. Our Google API use follows Google's Limited Use policy. Revoke from Google in one click — we lose access immediately.
Microsoft 365 & Outlook (coming fall 2026)
Calendar sync is Google today; Outlook / Microsoft 365 calendar sync and OneDrive folders are coming fall 2026. When they ship, they'll use the same OAuth 2.0 scope minimization and one-click revoke from your Microsoft account.
Dropbox
OAuth 2.0 with scoped folder access for workpaper sync. You authorize a specific path; we cannot read anything else in your Dropbox.
We store only the OAuth refresh token (encrypted) and the scopes you granted. No passwords, ever — not from you, not from anyone.
Backups & recovery
Daily encrypted backups. Point-in-time restore.
Postgres is backed up every 24 hours, encrypted at rest, and retained for 7 days. Supabase's point-in-time recovery lets us restore the database to any second within that window if something catastrophic happens.
Daily encrypted database backups
7-day retention. Same-region encrypted storage.
Point-in-time recovery (PITR)
Restore the database to any second within the retention window.
File storage replication
Workpaper uploads inherit S3's 11-nines durability within the region.
USPAP workpaper retention
Your workpapers stay yours for as long as USPAP says they have to.
USPAP Record Keeping Rule requires you to retain workpapers for a minimum of five years (or two years after final disposition of any judicial proceeding, whichever is later). Appraisal Ally keeps every record you create for the life of your subscription. If you cancel, you get a final export window to pull everything out as CSV + PDF before the workspace is archived. We do not auto-delete workpapers under retention.
One honest distinction: the 7-day database backup window above is our disaster-recovery net, not your USPAP archive. Appraisal Ally is the office layer — the log, schedule, invoices, and payments — not your workpaper system of record. Your actual USPAP workpapers live in your report tool, and that's where your five-year retention should be anchored.
Vulnerability disclosure
Found something? Tell us.
If you believe you've found a vulnerability in Appraisal Ally, email support@appraisalally.com. We respond within one business day, acknowledge confirmed issues publicly with credit (with your permission), and fix high-severity issues on a priority schedule.
- Test only against your own workspace — never another business's data.
- No DDoS, social engineering, or physical attacks.
- We'll work in good faith with researchers who do the same.
Security contact
Email: support@appraisalally.com
Response SLA: 1 business day for acknowledgement.
Data ownership
Your data is yours. Always.
No lock-in. No held-hostage exports. Workpapers belong to the appraiser who made them.
Export everything, any time
CSV exports for appraisals, clients, AMCs, invoices, payments, and calendar events are built into the app. PDF exports for individual records. No support ticket required, no extra cost.USPAP workpaper retention
Every record you create stays in your workspace for the life of your subscription, then through any export window after cancellation. You own your workpapers — we're custodians, not gatekeepers.Continuity if we disappear
If Appraisal Ally ever shuts down, you get full CSV + PDF export of every record, on demand, forever. See the continuity statement on /about.
Need a security overview for a lender or AMC?
We'll send a single-page summary covering everything on this page in a format your client can attach to a file. Email security@appraisalally.com and we'll reply within one business day.
For AMC vendor reviews: Appraisal Ally is US-hosted, with data encrypted in transit and at rest, and Stripe handles all card data — we never touch it. We are not SOC 2 certified yet; it's on the roadmap, and we'll say so plainly rather than imply otherwise. A security packet is available on request. We also recognize that your AMC engagement agreements can dictate how order data is handled, and we're glad to work within those terms.
Anything else? Email us at support@appraisalally.com.
Run the business. Don't run after it.
14-day free trial when we open. No card to join. US-hosted, encrypted at rest and in transit.