DeviceChart

Trust

Security

Last updated July 2, 2026

Plain-English summary of how DeviceChart isolates your data, what’s encrypted, and what we log. No SSO/directory integrations, no monitoring agents, and no network scanners — DeviceChart only knows what your team enters, imports, or emails in.

Tenant isolation

Every organization’s data is isolated with Postgres row-level security (RLS) policies keyed on organization ID and role — enforced by the database itself, not just hidden in the app’s UI. A bug in a page or API route cannot leak rows across organizations, because the database rejects the query before it can return them.

Role-based access

Every person has one role: admin, manager, viewer, or auditor. Roles gate what a person can see and do — for example, only admins can reveal recovery keys, and viewers/auditors never see cost or invoice figures. These rules are enforced in RLS policies, not only in the interface.

Sensitive values: masked by default

Fields like disk recovery keys render masked (••••••••) everywhere in the app. Viewing the real value is a deliberate, separate action — a “reveal” — and every reveal is written to the audit log with who did it and when.

Encryption

Data in transit is encrypted (HTTPS/TLS) everywhere, including to and from Supabase and Stripe. Data at rest is encrypted at the infrastructure level by Supabase’s managed Postgres.

PlannedApplication-level encryption of disk recovery keys (AES-256-GCM, ciphertext at rest, decrypted only for an audited reveal) is scoped for our Phase 2 release. Being straightforward about this: it is not live yet. Until it ships, treat the recovery-key vault as not-yet-available rather than assume it’s already encrypted at the application layer.

Audit log

Every create, update, delete, secret reveal, invoice download, sign-in, and import is written to an append-only audit log, visible to admins and auditors. Entries are never edited or deleted by the app. Admins and auditors can export the full log as CSV at any time from the audit page.

What we deliberately don't do

  • No Entra/Okta/SAML or directory sync.
  • No monitoring agents installed on your devices.
  • No network discovery or scanning.
  • No integration marketplace or third-party connectors.
  • No browser extensions, SSO/OAuth discovery, or bank-feed connections for software tracking.
  • No storage of your other systems’ passwords.

DeviceChart’s job is to be the one honest register of what you own and pay for — not another agent running on your network.

Infrastructure

Hosted on Vercel; database, auth, and RLS on Supabase (managed Postgres); billing on Stripe; transactional email on Resend. See our privacy policy for the full subprocessor list.

Reporting a concern

Found a security issue or have a question about our posture? Email support@devicechart.com — we read every report.