Security at RIA Ascent
Firms tell us things their filings do not show. This is how that information is protected, who can reach it, and who we run on.
How your data is protected
- Encrypted in transit and at rest. Traffic to the application and the API is encrypted in transit, and the providers that store your data encrypt it at rest — the table below names what each of them publishes.
- Least privilege. Our team can reach only what a role needs in order to run and support the product, and access to production is granted to a person rather than held by default.
- Two-factor authentication is required on every account that can administer our code, our infrastructure or production data.
- Background and criminal-records checks. Everyone with access to production passes one before that access is granted.
- Credentials live in our providers' encrypted settings, never in our code.
Who can see your firm's data
- Your valuation, the answers you submit and your corrections are visible only to a verified owner of your firm. A colleague who links to the same firm sees the score, its band and its confidence level.
- The public firm profile carries no score and no valuation, and automated tests fail our build if either ever appears there.
- A verified claim means our checks passed — not that we have confirmed who owns a business, and not an endorsement. §4 of the Terms sets out what it does and does not mean.
- How we use your data sets out who sees what, and what you control, in full.
Infrastructure and providers
RIA Ascent runs on managed infrastructure. Each provider below holds its own SOC 2 Type II report.
| Provider | What we use it for | Attestations | Encryption |
|---|---|---|---|
| Vercel | Hosts and serves the web application | SOC 2 Type 2, ISO 27001:2022 | TLS 1.3 in transit; AES-256 at rest |
| Railway | Runs the API and background jobs | SOC 2 Type II, SOC 3 | TLS in transit; encrypted at rest |
| Supabase | Database and sign-in | SOC 2 Type 2, ISO 27001 | TLS in transit; AES-256 at rest |
| Sentry | Error monitoring | SOC 2 Type II, ISO 27001 | AES-256 in transit and at rest |
| Resend | Account and notification email | SOC 2 Type II | TLS 1.3 in transit; AES-256 at rest |
Each provider's name links to the page these details come from. They are the providers' own published claims rather than assurances we make on their behalf, and we checked them on 27 September 2026.
Monitoring and change control
- Errors in the application and the API are reported to our monitoring, and raise an alert to the team.
- Every change is checked automatically before it can ship: code and type checks, unit and end-to-end tests, a scan for credentials committed by mistake, and a check of the packages we ship against published vulnerability databases.
- Changes reach production only through reviewed pull requests, and every database change is a versioned migration applied by that same pipeline.
- Public lookups are rate limited to keep the service available.
Certification status
RIA Ascent is not yet SOC 2 certified. We are building our infrastructure and processes toward a SOC 2 Type II audit. Our hosting providers — Vercel, Railway and Supabase — each hold their own SOC 2 Type II reports.
The practices on this page are the groundwork for that audit.
Report a concern
Email hello@riaascent.com with a subject line starting “Security”, telling us what you found and how to reproduce it. Please do not access, change or keep data that is not yours, and do not run tests that degrade the service for others — §7 of the Terms covers this. Our machine-readable contact details are at /.well-known/security.txt.