Back

Security

Information Security Policy

Our controls, infrastructure, and commitments for protecting your data.

Information Security Policy

Last updated: June 22, 2026

This document describes the security controls, practices, and commitments that govern the Last Mile Strategies Client Portal ("the Portal"). It is intended for clients, prospective clients, and integration partners evaluating our security posture.

Questions or concerns: security@lastmilestrategies.com

Overview

Last Mile Strategies operates the Portal as a cloud-native, serverless application. We handle financial data — supplier invoices, spend transactions, and vendor benchmarks — on behalf of professional services clients. Our security program is designed to protect the confidentiality, integrity, and availability of that data.

This policy covers the Portal application and the infrastructure it runs on. It does not cover on-premise software or client-side environments.

Infrastructure and Hosting

The Portal runs entirely on two cloud providers operating within the United States:

Cloudflare Workers — application compute layer. The Portal is deployed as a Cloudflare Worker (via opennextjs-cloudflare). All HTTP traffic passes through Cloudflare's edge network, which provides DDoS mitigation, WAF filtering, and TLS termination. No persistent server processes run outside of Cloudflare's infrastructure. Invoice files are stored in Cloudflare R2 (object storage).

Supabase — database, authentication, and file storage. Supabase hosts the Postgres database (us-east-1 region) that stores client accounts, transaction metadata, and organizational data. Supabase provides the authentication service (session management, MFA, passkeys). Database traffic between the Worker and Supabase travels over TLS on private networking.

Neither provider sub-licenses Portal data for their own commercial purposes. See our Sub-processors page for the full list of vendors that touch customer data.

Data Encryption

In transit: All Portal traffic is served exclusively over HTTPS. Cloudflare enforces TLS 1.2 as the minimum version; TLS 1.3 is preferred. There is no HTTP fallback. Internal service-to-service calls (Worker ↔ Supabase, Worker ↔ Ramp API, Worker ↔ QuickBooks API) are also encrypted in transit.

At rest: The Supabase-hosted Postgres database uses AES-256 encryption at the storage layer, managed by the underlying cloud provider. OAuth tokens for third-party integrations (QuickBooks Online, Ramp) are additionally encrypted at the application layer with AES-256-GCM before being written to the database — the encryption key is stored separately as a Worker secret, not in the database. This means a database credential leak does not expose integration tokens.

Passwords: User passwords are never stored. Authentication is managed by Supabase Auth, which uses bcrypt hashing with a per-password salt. We additionally check passwords against the HaveIBeenPwned k-anonymity API during account creation and password changes — a leaked credential is rejected before it is ever set.

Access Controls and Authentication

Row-Level Security (RLS): Every table in the Portal database has Postgres Row-Level Security policies enforced at the database layer. A compromised application credential cannot read another client's data — the database itself enforces the isolation. RLS policies are reviewed on every schema migration.

Role-based access: Portal accounts carry one of two roles — client_admin (full account access, can invite teammates and manage integrations) and client_member (read and standard workflow access). Role assignment is controlled by client_admin users within the tenant; Last Mile Strategies staff have a separate lms_admin role scoped to administrative tooling.

Multi-factor authentication (MFA): MFA via TOTP authenticator app is available to all Portal users and can be enrolled from Account Settings. Passkeys (FIDO2/WebAuthn) are also supported as a phishing-resistant second factor or passwordless credential.

Trusted devices: Users may mark a device as trusted after MFA verification. Trusted-device records are stored as HMAC-signed tokens; the plaintext device ID never leaves the client. Records expire and can be revoked from Account Settings.

Staff access to production: Direct database access is restricted to a single named administrator. All schema changes are applied via versioned, reviewed migrations. There is no standing shell access to application infrastructure.

Third-Party Integration Scope

The Portal integrates with QuickBooks Online and Ramp to ingest spend data. Both integrations are configured with the minimum OAuth scope required:

  • QuickBooks Online: read-only accounting data (invoices, bills, vendors). No write access is requested or granted.
  • Ramp: transactions:read only. No ability to initiate payments, modify cards, or change account settings.

Integration tokens are stored encrypted (see Data Encryption above) and are scoped per-tenant. Disconnecting an integration from the Portal revokes the token.

Data Retention and Deletion

Client data is retained for the duration of the customer relationship. On account deletion:

  • All transaction records, benchmarks, and organizational data are permanently deleted from the primary database.
  • Invoice files stored in Cloudflare R2 are deleted.
  • Integration tokens are revoked and removed.

Deletion requests can be submitted to privacy@lastmilestrategies.com. Deletion is completed within 30 days of confirmation.

Supabase and Cloudflare may retain backup snapshots for up to 30 days after deletion per their standard retention policies; these snapshots are covered by the same encryption-at-rest controls as primary storage.

Incident Response

Last Mile Strategies maintains an incident response process for security events affecting customer data:

  1. Detection and containment — on discovery of a potential breach, the affected service or tenant is isolated within one business hour.
  2. Investigation — root cause analysis is conducted and scoped before notification.
  3. Customer notification — affected customers are notified within 72 hours of confirming that a breach occurred, or earlier if required by applicable law. Notification includes the nature of the event, data affected, and remediation steps taken.
  4. Post-incident review — all confirmed incidents trigger a written post-mortem and controls update.

To report a suspected vulnerability or security incident: security@lastmilestrategies.com

Certifications and Assessments

Last Mile Strategies does not currently hold SOC 2 Type II, ISO 27001, or other third-party security certifications. We are actively evaluating SOC 2 Type I as the organization scales.

In lieu of a formal audit report, we are happy to provide:

Contact

Security inquiries and vulnerability disclosures: security@lastmilestrategies.com

Privacy and data handling questions: privacy@lastmilestrategies.com

We aim to acknowledge security disclosures within one business day and to provide a resolution timeline within five business days.