Trust
Security at TradeProof
Your subs' insurance certificates and W-9s are sensitive. Here is exactly how we protect them — in plain English.
Encryption
- All traffic uses HTTPS (TLS) — between your browser, our servers and our providers.
- Data and files are stored encrypted at rest by our hosting provider.
- W-9 tax ID numbers get an extra layer: they are encrypted by TradeProof (AES-GCM) before they are stored, and the app only ever shows the last 4 digits.
Documents
- Certificates and W-9s are kept in private storage — nothing is public.
- Files open only through signed links that expire after 5 minutes.
- Uploads are checked: a file that isn't a real PDF, JPG or PNG is deleted.
Logins
- Passwords must be at least 10 characters with letters and numbers, and common passwords are refused.
- Two-step verification with an authenticator app, enforced by the database for accounts that turn it on.
- See every signed-in device and log out everywhere from Settings.
Who can see your data
- Your team: only people you invite to your company. Every database query is limited to your own company (row level security).
- Your subcontractors: only their own upload page, through a private link — never other subs or your account.
- TradeProof support: read-only access for support, only with two-step verification, and every admin action is recorded in an audit log.
Records and history
- Activity history: who added, approved, rejected or changed what, and when.
- Every email sent to your subs is logged with its status.
Your data, your call
- Export everything as a ZIP at any time (W-9 numbers show only the last 4 digits).
- Delete your account from Settings: everything is permanently deleted after a 30-day grace period.
Hosting and payments
- Hosted on Lovable Cloud, built on Supabase (PostgreSQL).
- Payments are handled by Paddle, our Merchant of Record — TradeProof never sees or stores card numbers.
Buying for a larger company?
The procurement kit has a pre-filled security questionnaire, our standard terms and data protection agreement, and invoice details — all downloadable.
Found a security issue? Email support@usetradeproof.com.