Security

Last updated: June 2026

FixMy.Money handles sensitive client data on behalf of credit repair agencies. This page describes the security measures we have implemented and the claims we can verify. We only state what is technically accurate.

Verified Claims Only

This page only describes security measures that are technically implemented and verifiable. FixMy.Money has not completed SOC 2 certification. Infrastructure providers (Supabase, Stripe, Vercel) maintain their own certifications for their respective services.

Encryption in Transit

All data transmitted between your browser and FixMy.Money is encrypted using TLS 1.2 or higher. This applies to all API requests, file uploads, and authentication flows.

Encryption at Rest

Data stored in the FixMy.Money database is encrypted at rest. This is provided by our infrastructure provider, Supabase, which runs on enterprise-grade cloud infrastructure.

Authentication

FixMy.Money uses Supabase Auth for secure authentication. This includes email verification, session management, secure password handling, and support for Google OAuth. We recommend enabling two-factor authentication for all team accounts.

Row-Level Security (RLS)

Every sensitive database table has Row-Level Security policies enforced at the database level. These policies ensure that queries only return records belonging to the authenticated user's organization — even if application-level code has a bug.

Workspace Isolation

Each agency account operates in an isolated workspace. Client records, documents, disputes, billing data, and audit logs are scoped to your organization ID. No user can query another organization's data.

Role-Based Permissions

Team members are assigned roles that control what they can view and modify. Admin roles are protected and cannot be self-assigned. Service-role keys are never exposed to client-side code.

Audit Logging

All significant platform actions are recorded in an immutable audit log with timestamps and user attribution. Standard users cannot edit or delete audit log entries. Audit logs support your compliance documentation.

Infrastructure and Backups

FixMy.Money runs on Supabase, which provides automated database backups, high availability, and enterprise-grade cloud infrastructure. Supabase maintains its own security certifications for its infrastructure. FixMy.Money itself has not completed SOC 2 certification.

Data Retention and Deletion

You can request deletion of your account and associated data. Upon account deletion, your organization's data is removed from active systems. Contact support@fixmy.money to initiate a data deletion request.

Data Export

Agency and Professional plan subscribers can export their client data, dispute records, and documents. Contact support@fixmy.money if you need assistance with a data export.

Payment Security

All payment processing is handled by Stripe, a PCI DSS Level 1 certified payment processor. FixMy.Money never stores raw credit card numbers or sensitive payment data. Stripe maintains its own security certifications.

AI Data Handling

When you use AI features, credit report data and client information is sent to our AI processing pipeline. We do not use your uploaded credit reports or client data to train AI models. AI-generated content must be reviewed by an authorized user before it is sent, filed, or relied upon.

Two-Factor Authentication

Two-factor authentication is available through Google OAuth. We recommend all team members enable 2FA on their Google accounts when using Google sign-in. Native TOTP 2FA is on our roadmap.

Incident Response

In the event of a security incident affecting your data, we will notify affected customers as required by applicable law. Security incidents should be reported to security@fixmy.money.

Subprocessors

FixMy.Money uses the following third-party services to deliver the platform. Each subprocessor handles data only as necessary to provide their service.

Provider	Purpose	Location
Supabase	Database, authentication, and file storage	United States
Stripe	Payment processing and billing	United States
OpenAI	AI credit report analysis and letter generation	United States
Google Analytics	Anonymous usage analytics	United States
Vercel	Application hosting and edge delivery	United States

Security Checklist for Administrators

Recommended steps for agency administrators to maintain a secure FixMy.Money environment.

Enable two-factor authentication on your account
Review team member access and remove inactive users
Verify that all team members have appropriate role assignments
Review the audit log periodically for unexpected activity
Ensure client documents are organized and access-controlled
Confirm billing contact information is current
Review and update your workspace settings
Test your client portal login to verify it works correctly

Responsible Disclosure

If you discover a security vulnerability in FixMy.Money, please report it responsibly to security@fixmy.money. Please do not publicly disclose vulnerabilities before we have had a reasonable opportunity to investigate and respond. We take all security reports seriously.