Nothing sends until
you activate.
Thaw exercises far less than the access Stripe issues it, isolates every merchant's data, and logs everything it does. Here's exactly how — no call required.
Live controls
- EnforcedRow-level security (tenant isolation)
Postgres RLS + is_member() policy on every table (supabase/schema.sql)
- EnforcedLeast-privilege access roles
owner/approver/viewer enforced in code via guard() (src/lib/team.ts)
- EnforcedImmutable audit trail
append-only event_log; every state change calls logEvent()
- EnforcedEncryption in transit
TLS on all endpoints (Vercel) and provider connections
- In placeEncryption at rest
Supabase/Vercel managed encryption at rest
- EnforcedWebhook idempotency
webhook_events ledger dedupes Stripe event ids
- EnforcedData retention & deletion
disconnect cancels scheduled actions; daily purge cron scrubs end-customer PII 90 days after disconnect (src/lib/purge.ts, /api/cron/purge)
- In placeUptime monitoring
status_checks probes every 10 min; public /status page
- In placeDocumented security policies
docs/security/POLICIES.md — access control, change management, incident response, BCP/DR, vendor management, data classification, encryption, logging, vulnerability management
- In placeRisk assessment
docs/security/RISK-REGISTER.md — rated risks with an owner and an explicit mitigation or acceptance; reviewed quarterly
- In placeControl mapping to Trust Services Criteria
docs/security/CONTROL-MATRIX.md — CC1–CC9, A1, C1 mapped to the implementing file and the evidence to pull; open items listed rather than omitted
- EnforcedChange management
every change via PR with unskippable CI gates; main the only deployable branch; destructive migrations rejected in CI without an explicit marker and rollback plan (.github/workflows/db-migrate.yml)
- EnforcedVulnerability management
Dependabot weekly + security advisories; npm audit --audit-level=high weekly in CI (.github/workflows/security-scan.yml); remediation targets by severity in POLICIES.md §13
- EnforcedVulnerability disclosure channel
SECURITY.md with response targets and safe-harbour terms; machine-readable contact at /.well-known/security.txt (RFC 9116)
- In placeIncident response plan
POLICIES.md §4 with phase targets (triage 4h, retro 5 business days); incident log at docs/security/incidents/; tabletop scenario written and not yet run (docs/security/TABLETOP.md)
- RoadmapBackup restore tested
Supabase managed backups in place; no restore has been performed yet. Runbook and automated verification ready (docs/security/RESTORE-TEST.md, npm run verify:restore)
- RoadmapSOC 2 Type II report
Policies and risk register documented; controls operating. No auditor engaged yet — readiness state and gaps are stated in docs/security/SOC2-READINESS.md
Payments & card data
Card data never touches Thaw. Payment processing stays entirely with Stripe (PCI DSS Level 1). We only ever see tokens and metadata — never full card numbers. Your fee card is collected through Stripe's own SetupIntent and stored by Stripe, not us.
Access to your Stripe
Stripe offers platforms a single access level, so its consent screen asks for read and write. We say so plainly rather than claim a narrower grant than Stripe will issue. What matters is what the audit does with it: two read calls, for subscriptions and invoices.
Recovery is gated on activation, not on the grant — nothing is scheduled, sent, retried or charged until you accept the agreement and add a card, which is a separate, logged step. You can disconnect in one click anytime, or revoke Thaw directly from your Stripe dashboard, and every permission change is in the audit log.
Data security & isolation
- Postgres with row-level security (RLS): every query is scoped to your team's membership — one merchant can never read another's data.
- Service-role keys are server-only and never shipped to the browser; no secrets in client bundles.
- TLS in transit; encryption at rest via our infrastructure providers.
- Least-privilege roles inside your account too — owner, approver, viewer.
Your customers' data
For your end customers, Thaw is a data processor acting on your instructions. We send recovery emails on your behalf, with a one-click unsubscribe on every message and a suppression list honored everywhere (CAN-SPAM / GDPR). We never sell data, and we never use your customers' data to train models.
Compliance
- SOC 2: groundwork in place (immutable audit log of every action); Type II report on the roadmap.
- Controls are mapped to the Trust Services Criteria, with the open items — MFA evidence, the first access review, an untested backup restore — stated rather than omitted.
- Security reports: security@thawpayments.com, with response targets and safe-harbour terms. Machine-readable contact at /.well-known/security.txt.
- GDPR: a Data Processing Agreement is available below. Thaw is the processor; you are the controller.
- Card-network rules: retries respect Visa/Mastercard reattempt limits (combined-attempt governor).
- Email: dunning is transactional; winback marketing carries mandatory unsubscribe.
Data retention & deletion
Disconnecting revokes access and cancels all scheduled actions immediately. Your data is retained for 90 days then purged. You can request deletion at any time and we'll honor it.
Subprocessors
- StripeDPAPayment data & connected-account access
- SupabaseDPADatabase, authentication (row-level security)
- VercelDPAApplication hosting
- ResendDPATransactional & recovery email delivery
- AnthropicDPAAI-generated recovery copy (no training on your data)
- Google WorkspaceDPASupport, privacy, and security inboxes
Audit trail
Every retry, email, scope change, and billing event is written to an immutable event log. Attribution and fees are re-derivable from that ledger — you can always see exactly why you were charged.