Verified-first intelligence
Core financial metrics are calculated from structured data before AI is used to explain them.
Workspace isolation
Authenticated business workspaces use owner-scoped database access controls rather than a shared unrestricted dataset.
Server-side secrets
Privileged Supabase, Stripe, and AI credentials are intended to stay server-side rather than being exposed to browser code.
Verified billing events
Subscription state is synchronized from Stripe using signed webhook events and authenticated refresh flows.
AI usage controls
AI endpoints include usage logging and rate protections designed to reduce abuse and unexpected cost.
Owner data controls
Workspace owners can export current Solvryn data and use a guarded account-deletion flow from Settings.
How Solvryn handles financial calculations
Solvryn's design principle is: raw financial data → deterministic calculations → structured metrics → AI explanation. AI is not intended to invent the underlying revenue, expense, profit, margin, score, or forecast inputs used by core product features.
Current data-access model
Business records are associated with authenticated owners and protected through application authentication and database row-level access policies. Server-only operations use privileged credentials only in server-side code paths.
Billing security
Solvryn uses Stripe-hosted billing flows so payment-method collection is handled by the payment provider. Subscription events received by Solvryn are verified using Stripe webhook signatures before billing state is synchronized into the application database.
AI controls
AI features are designed to receive verified financial context generated by Solvryn and include request protections such as rate limits and usage logging. AI remains probabilistic and is subject to the limitations in the Financial & AI Disclaimer.
Data ownership and deletion
Customers retain ownership of Customer Data. Current account controls include business-profile management, data export, and a deliberate account-deletion flow. Deletion may be subject to limited backup, security, billing, or legally required retention as described in the Privacy Policy.
What this page does not claim
This Trust Center describes current product design principles; it is not an audit report, penetration-test report, security certification, SOC 2 report, ISO certification, PCI certification, or guarantee that a security incident cannot occur. Solvryn should not display certification badges or make compliance claims unless those certifications have actually been obtained.
Security reporting
If you believe you found a security issue, avoid accessing data that does not belong to you and report the issue through the support or contact channel available on the Solvryn website or inside your account. Do not publicly disclose sensitive exploit details before Solvryn has had a reasonable opportunity to investigate.