Security
Built to survive a compliance review
You hold a fiduciary duty to your clients. This page sets out precisely how their assessment data and your account are protected, and what we deliberately never collect.
The strongest control we have
The data we never collect cannot be breached
Most tools in this space defend a large pile of sensitive client data. We took the other route and built a product that barely needs any. For each of your clients we hold the name you typed, 24 assessment answers, six dimension scores, and an archetype. That is the entire file.
What Client Chemistry never receives
There is no field anywhere in the product to upload a transcript, a statement, or a client document. Your clients' sensitive data stays in your CRM and your custodian, where it belongs.
The one exception, stated plainly
When you invite a client, you can optionally add their email address so we send them the assessment link for you. We use it for that one message, and we delete it the moment they finish the assessment. Leave the field blank and we never receive it at all: you get a link to send them yourself.
Account and data protection
How logins and reports are secured
Passwords are never stored in readable form
Authentication is handled by Supabase Auth. Passwords are hashed with bcrypt before they reach storage. Hashing is one way: unlike encryption, there is no key that turns it back. We do not see, log, or store your password in any readable form, and no one at Client Chemistry can retrieve it.
The database itself refuses cross-firm access
Every table has row-level security enabled, scoped to your firm. This is enforced by Postgres, not by application code, so even a bug in our app cannot hand another advisor your clients. On top of that, every server request re-checks that the record belongs to your firm before it returns anything.
Encrypted in transit and at rest
All traffic runs over TLS 1.2 or 1.3, with older versions refused outright. The database is encrypted at rest by our infrastructure providers. HTTPS is enforced by HSTS with preload, so a browser will not fall back to an unencrypted connection even on the first visit.
Privileged keys never reach the browser
The service key that can bypass row-level security exists only on the server and is never bundled into any page. Internal report-generation endpoints additionally require a shared secret, so they cannot be triggered from a browser at all.
Sessions are hardened
Sessions use HTTP-only cookies, so page scripts cannot read your session token. The app cannot be embedded in a frame, and we deny camera, microphone, geolocation, and payment permissions outright.
Signup is closed during the beta
Accounts can only be created with an invite code we issue, so the surface is a small, known group of advisors rather than the open internet.
Connecting your own AI is read-only, and your choice
You can generate a key that lets your own AI assistant read your client playbooks, so its drafts match how each client likes to hear from you. The connection is outbound and read-only: your AI can read the finished report, archetype, and dimension scores, never a client’s raw answers, and it can never write or change anything. Each key is scoped to your firm, every access is logged, and you can revoke it in one click. One honest note: when you connect an AI, you choose to share that playbook text with your AI provider, who processes it under your own agreement with them, not ours.
Compliance
Built on audited infrastructure
Client Chemistry runs on independently audited infrastructure. We do not sell your data, we do not share it with other advisors or firms, and we do not use it for advertising.
The service providers we rely on, what each one does, and where it operates, are listed and kept current in our Data Processing Agreement.
If your firm needs a due-diligence questionnaire or specific documentation before onboarding a vendor, contact info@clientchemistry.com.