Security & data handling
Everyone can build software now. Fewer people will tell you exactly what happens to your data, in writing, before you ask. This is that page.
Where your data lives
In the United States. The application runs on Vercel; the database, file storage, and authentication are Supabase, hosted on AWS in US regions. Nothing is moved outside the US without telling you first.
Who can see it
Kevin, and no one else. There are no other employees and no contractors with production access. Every account that matters — hosting, database, payments, domain, email — is protected by multi-factor authentication, and so is yours: sign-in here takes a password plus a code from your authenticator app, enforced on every page behind the login.
Encryption
In transit over TLS everywhere, with no unencrypted fallback. At rest by the storage platform. Secrets live in the hosting platform's encrypted environment, never in the repository and never in a chat message.
What is logged
Meaningful actions on your records are written to an activity log: what happened, to which record, by whom, and when. We build the same into the software we ship you, by default rather than on request.
Separation between clients
Your records are isolated at the database level by row-level security, not by application code remembering to filter. The software we build for you is deployed to infrastructure that is yours, separate from ours and from other clients'.
Backups, and proof they restore
The database is backed up continuously by the platform, with independent copies held separately. A restore is rehearsed rather than assumed — we perform one deliberately and record that it worked and how long it took.
How long we keep things
Working Session materials, briefs, and delivered work are kept for the life of the engagement and two years after, so you can come back to them. Meeting recordings and transcripts are kept 90 days unless you ask otherwise. You can ask for anything to be deleted at any time.
Deleting your data
Ask, and it goes — within 30 days, across the database, file storage, and backups as they roll off. You will get written confirmation of what was removed. What we must keep for tax or legal reasons is named explicitly rather than quietly retained.
If something goes wrong
We keep a written incident response plan. If your data is involved in a security incident, you will hear from us within 72 hours of us confirming it, with what we know, what we do not yet know, and what we are doing. You will hear it from us rather than from someone else.
What we will not do
Your data is not sold, not shared with anyone outside the subprocessors listed here, and not used to train anyone's model. We decline work we cannot secure.
The whole picture, on one page.
Security reviewers ask for this and rarely get it. Two boundaries do most of the work: card details go from your browser straight to Stripe and never reach our servers, and protected health information never enters our platform at all.
Healthcare, legal, and financial work.
Healthcare. We build HIPAA-compliant systems and sign a Business Associate Agreement. Protected health information lives in your deployment, on infrastructure with BAAs executed before any real data arrives — never on Ultramar’s own platform. That is a deliberate design decision: the fewer places PHI can be, the fewer places it can go wrong. The compliance tiers that carries are itemized in your proposal, so you see what they cost rather than finding them buried in a rate.
Legal. Client confidentiality is a professional obligation we take on with you. We will sign a confidentiality agreement, keep matter data separated, and stay away from trust accounting entirely — we read from your systems of record, we do not write to them.
Financial. We work alongside a core system rather than touching it, and we scope the first engagement deliberately away from customer financial data. We will complete your vendor due-diligence questionnaire and give your examiners what they ask for.
We do not claim to be “HIPAA certified” — no such certification exists, and any vendor who says otherwise is telling you something that cannot be true.
The complete list of companies involved in running this.
It is finite, it is public, and it is dated. If it changes, this page changes.
- VercelRuns the application and serves the site. US regions.
- SupabaseDatabase, file storage, and sign-in. Hosted on AWS in the United States.
- StripePayments. Card details go to Stripe directly and never reach our servers.
- ResendSends transactional email — confirmations, secure links, receipts.
- DailyCarries the video and audio for meetings. Media is not recorded unless you are told and agree.
- DeepgramSpeech-to-text during a meeting, when live notes are switched on with your consent.
- CartesiaThe concierge's voice. Synthesis only — it is given text to speak.
- AnthropicDrafts live notes and session recaps from meeting transcripts. Not used to train models.
- TelnyxCo assistant text delivery when messaging is activated, after your consent and number verification. Processes mobile numbers, message content and delivery information.
- Twilio VerifyDelivers and checks sign-in verification texts when you choose SMS. Receives your mobile number and verification request; Supabase controls account access.
- GitHubSource code for the software we build. Your code, in a private repository.
- CloudflareDNS for our domains.
Last updated 22 September 2026. Ultramar Labs LLC trades as Ultramar Labs — it is the entity you contract with, and the one named on any insurance or Business Associate Agreement we hold or sign.
Questions about any of this, or a security questionnaire you need completed? Ask directly.
Ask the hard question first.
Bring the security questionnaire, the BAA, or the thing your examiner wants. We'd rather answer it before a proposal than during one.