Trust, in plain ink.

Interline runs on four ideas, and the rest of this page is just consequences of them: every record carries a data classification, every meaningful action is written to an append-only audit trail, every row is scoped to exactly one tenant at the database boundary, and every operator sees the minimum information required to do their job. Security here is a structural property of the codebase, not a quarterly project that happens before an audit.

Every column, document, and event flowing through Interline is tagged with one of five classifications. The tag determines who reads it, where it can travel, and how long it is retained.

At rest. All Customer Data lives in PostgreSQL with native page-level encryption via the underlying managed disk. When we host, we standardize on AES-256 for the storage volume and a separate key per environment.

In transit. Every connection - browser to Next.js, Next.js to FastAPI, FastAPI to Postgres, FastAPI to AI inference - is TLS 1.2 or higher. HTTP requests on the public origin are redirected; HSTS is enforced.

Field-level for PHI. The schema reserves dedicated columns for highly-restricted fields and the ORM layer routes them through a field-level encryption wrapper. The wrapper is wired but inert until a Business Associate Agreement is signed; at that point the keys are provisioned per-tenant and the columns turn opaque to anyone without the decryption envelope. Wiring arrives with HIPAA BAA signing.

Every meaningful action - a review document drafted, an illustration uploaded, a policy assignment changed, a user invited - is written to an append-only audit log. Each entry carries the actor, the tenant, the affected record, and a SHA-256 hash that incorporates the previous entry's hash, forming a chain you can replay end-to-end. When a review is signed and issued, the system snapshots the rendered PDF and pins its content hash to the chain so that any later attempt to alter the artifact is detectable from the audit log alone. The result is a chain-of-custody record that survives regulatory inquiry and operator turnover.

Every row in every business table carries a non-nullable tenant_id. The ORM session is opened with a tenant filter before any query runs and the filter cannot be turned off from inside a request handler - there is no admin override that crosses the tenant boundary. A test suite asserts the property by attempting cross-tenant reads from inside one tenant's session and verifying that every endpoint either returns 404 or an empty collection for records belonging to another tenant. The suite runs on every commit; a failure blocks the merge.

We retain Customer Data for the life of the subscription. On termination we hold the data for a thirty-day grace window so the tenant can pull a final export, then we delete it from production within ninety days. Backups age out within twelve months. Audit logs retain for the duration set in the tenant's compliance settings, with a default of twelve months on Team and up to seven years on Enterprise.

A full CSV export of clients, policies, reviews, and audit entries is available from the workspace UI and over the REST API at any time. The export includes the hashes from the audit chain so the artifact can be independently verified after extraction.

Interline relies on a small set of subprocessors to operate. Each is bound by a written data-processing agreement and receives only the data needed for the stated purpose. The full list, what each receives, and how to subscribe to change notifications lives at /legal/subprocessors.

Today the list is intentionally short - Kinde for authentication, the hosting region for Postgres, plus future additions for managed AI inference and document delivery as those features ship. We will list each provider as it is onboarded and notify customers thirty days before a new subprocessor gains access to Customer Data.

If you find a vulnerability, send the details to [email protected]. We acknowledge within five business days, agree on a reproduction with you, and commit to a patch window of up to ninety days before any public discussion. We credit reporters by name in the changelog unless you ask us not to. We do not pursue legal action against researchers acting in good faith under this policy and we do not require an NDA for the initial report.

The machine-readable contact lives at /.well-known/security.txt per RFC 9116.