Your customer list is yours.

Isolation is enforced by the database, not by our code

Most software keeps businesses apart in application code: every query is supposed to include "…and only this customer's rows". It works right up until one query forgets, and then one business sees another's data.

TradeForge does it a layer lower. Every table has row-level security switched on inside PostgreSQL itself, with a policy tying each row to the business that owns it. If our application code forgets the filter, the database still refuses. The check does not depend on us getting every query right.

And a new table cannot ship without it

That has to stay true for the next table someone adds, too. So the database enforces the rule itself: whenever a table is created, row-level security is switched on automatically. Nobody has to remember.

What the 86 are

• 67 carry per-business policies — your contacts, jobs, quotes, invoices, photos, crew, compliance documents, your org chart and the rest. A signed-in user reaches their own business's rows and nothing else — and where the Hub's tools let you add or edit records, the database itself confines every write to your business.
• 19 are closed to customers entirely — TradeForge's own books, operational alerts and the marketing suppression list. These have security on and no customer policy at all, which means no customer account can read them under any circumstances.

We test it, rather than assume it

A rule like this can look right and still not do anything, and that kind of mistake stays invisible until the day it matters. So we test it: the test creates two real businesses with two real signed-in users, puts data in each, and checks that

• each user can see their own record
• each user cannot see the other's — the row simply is not there
• a signed-out visitor sees nothing at all
• a signed-in user CAN add and edit records with the Hub's own tools — and every such write lands only in their own business, enforced by the database
• a signed-in user cannot write a row into another business

The last two matter as much as the first three — being able to read someone else's records and being able to write into them are different holes, and both are closed. The test runs against the real database as ordinary signed-in users rather than as an administrator, and it clears up after itself. It last passed on 10 August 2026.

Owner sign-in has no password to steal

Owners sign in without a password: you enter your email and we send you a link that signs you in. A password we never hold is a password that cannot leak in a breach, cannot be reused from some other site's breach, and cannot be guessed.

The one exception is crew logins. A crew member you invite sets a password for their own login, because a shared jobsite phone can't always receive email. That password is held by Supabase, our sign-in provider, only as a salted hash — never in plain text, and never anywhere TradeForge can read it. A crew login can see the day's jobs and the crew's own messages; it can never reach your money, your customers, or your records.

What we do not do

• No analytics product. No Google Analytics, no Meta pixel, no Segment, Mixpanel, Amplitude, PostHog, Hotjar or anything of that kind. There is no tracking tag on any page of this site.
• No advertising tag, and nothing that follows you anywhere else on the internet.
• No cookies. Not one, including no "essential" cookie banner to click past — measured on the home page, the signup page and the customer hub.
• We do not sell your data, or your customers' data, to anybody. It is not a revenue line and never will be.
• We do not use your business's data to train AI models.

What we do store in your browser

Two things, and this is the complete list:

• How you first arrived — the referring site, and campaign tags if you clicked an ad or a link we published. This sits in your own browser's local storage on our domain, is captured once on your first visit, and is attached to your signup if you create an account, so we can tell which of our own efforts actually reach people. It is first-party, never shared, and goes no further than our own signup form.
• Your sign-in session, once you are logged in, so you are not asked to sign in on every page.

That is the whole list. Clearing your browser storage clears both.

Who else sees anything

A page cannot load without the browser contacting whoever serves its pieces, and those companies see the request. Here is every one of them and what they get. There are no others.

Who	What they receive	Why
Supabase	Your account data and your business's records	They host the database and sign-in. This is where your data lives.
Google Fonts	Your IP address and browser, when a page loads	Serves the typefaces. No account data reaches them.
jsDelivr	Your IP address and browser, when a page loads	Serves the database client library. No account data reaches them.
Stripe	Your card details, if and when you subscribe	Handles payment. TradeForge never sees or stores your card number.
Twilio	Your business's registration details (legal name, EIN, address, phone) and the text messages your customers send and receive — only if you use a texting package	Carries text messages. US carriers require a business to register before it can text, and that registration is filed with Twilio.
Google Maps	A job's address — only if you tap it	Job addresses on the crew and project pages are links that open in Maps. Nothing is sent unless you tap one.

Getting your data out, and getting it deleted

Both are built into the database and we run them on request. Here is what each one does.

• Export. One request returns every category — every kind of record we hold about your business, as a machine-readable file. Contacts, jobs, quotes, invoices and their line items, photos, calls and their transcripts, crew and timesheets, compliance documents, bookings, change orders, service plans, renewals, referrals, reviews, your branding, your billing history and the account itself. That list is read out of the database rather than typed by hand, so a new kind of record is in your export the day it exists. The single thing held back is our own internal notes about the business — those are about us, not about you.
• Deletion. Asking to be deleted deactivates your business immediately — the software stops, the account is marked closed, and nothing further runs. Your records are then permanently deleted after 30 days by a scheduled job, along with your login. The 30 days are there in case you change your mind. If you would rather not wait, tell us and we will erase everything the same day.

The five things we keep, and why

Five records stay behind. Each one is there for a reason that protects you as much as us, and they hold your business identifier and little else about you:

• Our own income records — what you paid us. Tax law does not stop applying because a customer left.
• Payment disputes, where any exist. If a payment is ever queried, this is the record that settles it.
• Proof you accepted the Terms — the record that an agreement existed, not its contents.
• The deletion request itself — our record that you asked, and that we carried it out.
• Our internal decision log, which is about us rather than about you.

Everything else goes: contacts, jobs, quotes, invoices, photos, calls and their transcripts, crew records, compliance documents, bookings, your settings, and the account you sign in with.

Both of those are functions in the database that we run on request, not a promise somebody has to remember to keep. See the Privacy Policy for retention periods and the legal detail, and the Terms of Service for the contractual side.

What we cannot claim yet

So that nothing above reads as more than it is:

• No SOC 2 or ISO 27001 certification. We are a new and small company and have not been through either audit.
• No independent penetration test yet. The isolation test above is a real test against the real database, but we wrote it. Nobody outside TradeForge has tried to break in on our behalf.
• No formal uptime commitment while we are pre-launch. See Status.

Found a problem?

Email tradeforgeoffice@gmail.com with what you found and how to reproduce it. A person will read it, usually the one who wrote the code. We will confirm what you found, fix it, and let you know when it is done.

The numbers on this page were measured against the live database on 10 August 2026. When they change, this page changes.