RaeSource
Security Overview
Last updated 9 September 2026 · RaeTech LLC
RaeSource holds three things worth protecting: who your salespeople are, what they record against a lead, and the fact that your company is bidding a particular job. This page describes how each is protected. It is written to answer a vendor security review without a call.
We have tried to make it specific. Where we do not do something, we say so rather than reaching for language that implies we do.
1. How your data is separated from everyone else’s
Every table in our database enforces row-level security keyed to your company. This is the control we would point to first, because it is enforced by the database rather than by application code.
The practical difference matters. In many systems, isolation is a filter the application remembers to apply, and a missing clause in one query exposes another customer’s records. In ours, the query runs as your user and the database returns nothing outside your company — a forgotten filter returns an empty result, not somebody else’s data.
Within your own company, an account is either admin or user. The team view and per-representative figures are shown to admins only. Be aware that this is how the application presents the data, not a wall inside it: RaeSource is a shared workspace, so anyone with a seat at your company can reach the same records underneath, and any of them can edit a lead another has worked. Who did what is kept in an append-only history. If you need reps walled off from one another, tell us — that is a different product shape and we would rather hear it than have you assume it.
2. Signing in
| Method | How it is protected |
|---|---|
| Email and password | We never receive or store your password. It is held by our authentication provider as a one-way hash. |
| Continue with Google | Optional. We request only your name and email address. We cannot read your mail, contacts, calendar or files, and we do not ask for the permissions that would allow it. |
Sessions are held in the browser and expire. Seats are created by your own administrator or by us at your request, and are revoked the same way — removing a seat removes access immediately.
3. Encryption
- In transit — TLS on every connection, to the application and to the database. The application is served over HTTPS only.
- At rest — encrypted by our database provider on AWS.
- On our own devices — company computers that can reach administrative credentials require full-disk encryption.
4. Administrative access
This is the part most questionnaires are really asking about, so we will be direct: RaeTech LLC is a small company, and administrative access to the production database is held by one person, the owner.
- The provider accounts that hold our infrastructure — our database, our payment processor, our code repository and our email — are protected by multi-factor authentication.
- Not yet true of the RaeSource staff console itself. Our own sales console signs in with an email and password, or with Google, and we do not yet require a second factor on it. Enrolling it is in progress. We would rather say so here than let you infer otherwise.
- Those factors are phishing-resistant where the provider supports it (passkeys), and authenticator applications elsewhere. We do not rely on SMS as a primary second factor.
- Administrative keys are held outside the application. No administrative credential is ever sent to a browser, which means it cannot be extracted from the app by a customer, an attacker or a curious developer.
- Credentials used by our automated jobs are stored encrypted by our build system, not in source code.
Our published application code is public and contains no secret keys. The key it does contain is one designed to be public; it grants nothing on its own, because access is decided by the row-level security described above.
5. Who else touches your data
| Provider | Purpose | Location |
|---|---|---|
| Supabase (on Amazon Web Services) | Database and authentication | United States — US East (N. Virginia) |
| GitHub Pages | Serving the application. No customer data is stored there. | United States |
| Stripe | Subscription billing | United States |
| Optional “Continue with Google” sign-in | United States |
These are our only subprocessors. We will update this list before adding another. There is no third-party analytics or advertising code in the RaeSource application — nothing tracks your salespeople as they work.
6. Payments
Card and bank details are collected and held by Stripe, certified to PCI DSS Level 1. We never see, receive or store a card number or a bank account number. Our systems see only whether a subscription is paid.
7. Availability and backups
- The database is backed up automatically by our provider on a daily schedule.
- The application itself is static and served from a content delivery network; it can be redeployed from source in minutes.
- Leads are refreshed nightly from public permit records. A failed refresh delays new leads; it does not affect data you have already recorded.
8. If something goes wrong
We maintain a written incident response procedure. In summary:
- We contain first — revoking credentials and sessions before investigating.
- We will notify affected customers within 72 hours of confirming an incident that involves their data, by email to the account contact.
- That notice will say what happened, what data was involved, what we have done, and what we recommend you do.
- We would rather tell you about an incident that turns out to be minor than wait until we are certain.
To report a vulnerability or a suspected incident, email support@goraetech.com with “Security” in the subject. We will acknowledge within one business day. We will not pursue anyone who reports a genuine flaw in good faith.
9. Your data is yours
- You can export what your team has recorded at any time by asking us.
- When a company’s seats end, its data is kept so a lapsed account can be restored intact. We delete it on request, and otherwise within 90 days of the account closing. That deletion is carried out by hand today rather than by a scheduled job, so 90 days is our commitment to you, not a timer running somewhere.
- An earlier deletion request will be honoured — see our Privacy Policy for the detail.
10. The framework we work to
We implement CIS Controls v8.1, Implementation Group 1 — the safeguard set the Center for Internet Security defines for organisations of our size. We self-assess against it and review it as the company grows.
What we do not claim. RaeTech LLC does not hold a SOC 2 or ISO 27001 attestation, and our CIS alignment is self-assessed rather than audited by a third party. Our infrastructure providers hold their own certifications, which cover their platforms and not our company — we will not borrow them to imply otherwise. If your procurement process requires an audited attestation from us, tell us early and we will discuss the timeline honestly rather than let it surface at signature.
11. Questions
If your security team needs something this page does not cover, write to us and a person will answer it.
RaeTech LLC
support@goraetech.com