Trust & Security

Every workspace's data is isolated at the database layer with PostgreSQL Row-Level Security enabled and FORCED on every table, with both USING and WITH CHECKpolicies. Every query runs inside a transaction scoped to a single workspace, so one tenant can never read or write another's rows. This isolation is covered by an automated cross-tenant test that is part of our definition of done.

• In transit: TLS 1.2+ for all connections.
• At rest: connection credentials (refresh tokens, API keys) are sealed with envelope encryption: a per-secret AES-256-GCM data key, itself wrapped by a key-encryption key held in a managed key vault, with key rotation support.
• Hard delete on disconnect: removing a connection destroys its stored credentials immediately, not on a schedule.

We request read-only scopes wherever a vendor offers them (for example, read-only Directory Readers via GDAP for Microsoft Partner Center), so reading your stack never requires write access. BillRecon writes back only the specific quantity correction you approve, or one that falls inside the auto-apply caps you set, and only on a connection you have explicitly armed for write-back. Everything else stays read-only, and every privileged action is recorded in an append-only audit log.

BillRecon is free during the beta, so there is no paid plan to cancel yet. When paid plans launch, canceling will make your account read-only and begin a defined deletion lifecycle. The same lifecycle runs on the right-to-erasure path you can trigger today:

• Credentials are destroyed immediately: every stored connection token and secret is hard-deleted the moment you disconnect or cancel, with no grace period. The highest-risk data leaves first.
• Your data is retained for a 30-day grace window (read-only) after a paid plan is canceled, so you can reactivate without losing your reconciliation history. After the window, all of your data is permanently deleted from the live service.
• Delete on demand: an owner or admin can erase your MSP workspace and all of its data at any time from Settings. This is the GDPR/DPA right-to-erasure path.

These steps are recorded in your audit log; the final erasure removes all of your data from the live service, including that log. Encrypted backups, which we keep only for disaster recovery, can retain a copy until they age out of our backup retention window, after which it is unrecoverable. We restore from backups only to recover from an incident, never to revive a workspace that has been deleted.

Our primary database runs with point-in-time recovery (PITR) enabled, and we test restores. Reconciliation snapshots are point-in-time and reproducible, so a run can always be explained and recomputed.

• Security questionnaires:we are happy to share our current security questionnaire (CAIQ/SIG-Lite) on request, and our service runs entirely on independently SOC 2 Type II / ISO 27001-certified providers (see Sub-processors below).
• GDPR / data processing: a Data Processing Addendum is available. See the DPA.

BillRecon runs entirely on SOC 2 Type II / ISO 27001-certified infrastructure. We use the following sub-processors to operate the service. Each maintains its own independent security certifications, shown below. We update this list before engaging a new one.

Certifications are maintained and published by each provider; we can share links to their trust centers on request.

Found a security issue? Email security@billrecon.com. We'll acknowledge promptly and keep you updated through resolution.

BillRecon is operated by BillRecon LLC. Last updated: June 26, 2026.