Security
Found a problem? Email security@traderail.com. Reports are welcome from anyone. Tell us what you found, how to reproduce it and, if you can, which screen or address. A person reads every report, you will hear back within two business days, and we ask for a reasonable time to fix it before anything is published. We will not take action against anyone who reports in good faith. Machine-readable details: /.well-known/security.txt.
How each company's data is kept apart
- Every company on TradeRail is a separate tenant. Every table and every file bucket carries the company it belongs to, and the database itself refuses a read or write across that line — not the page, the database. A second test company exercises that wall every night, and a failure raises an alarm the same morning.
- Office logins carry a second sign-in method (a passkey or an emailed link); phone sign-in codes are limited per number and lock after repeated wrong codes. Office sign-ins end after 12 hours, any sign-in after 30 idle days.
- Sensitive actions — changing roles, mailboxes, payment settings, removing a person, exporting everything — ask the owner's PIN again, and that is enforced in the database.
- Every change to money, sends, settings, people and sign-ins is written to an audit log nobody can edit, including the owner. Each record shows its own history.
- TradeRail staff can only open a company's account after its owner taps Allow; access ends after 24 hours and shows in the audit log.
Money and mail
- TradeRail never holds a card number. Cards and bank accounts are entered on Stripe's own form; TradeRail stores only a token and the last four digits.
- An invoice is marked paid only from a verified payment event or by a signed-in person whose name, time and method are recorded. Messages from payment and messaging providers are checked against each provider's signature before they are read.
- Every email leaves through one signed sending path. The no-login pages behind the buttons in customer emails use 32-character random links, one per document per recipient, that stop working after the document is paid or expires; every open is logged.
- The AI assistant in TradeRail (TRai) cannot send email, texts or money. It drafts; a person presses Send.
Keys, backups and checks
- Every secret lives in the server's secret store, never in code or the browser; the repository is scanned for secrets on every push; keys rotate on a schedule shown on each company's Security page.
- The database is exported every night to storage TradeRail owns outside its database host, and a restore from that export is practiced every quarter.
- The database's own security advisor runs before every release; an outside penetration test is scheduled before any company outside the founding one signs on.
If something goes wrong
TradeRail keeps a written incident plan: who decides, how every key is rotated and every session ended within the hour, how the audit log and server logs are preserved, and a plain-words notice to affected companies within 72 hours of confirming that personal data was reached.
Where TradeRail runs
The database, file storage and server functions run on Supabase (US West); the application is served by Cloudflare Pages; email, texting, payments and plan rooms use Google Workspace, Resend, Twilio, Stripe, Square and Procore under each provider's own security program. Their status pages: status.supabase.com, cloudflarestatus.com.