Security & Compliance

Our primary database and uploaded borrower documents are hosted by Supabase on AWS in Northern California, United States (us-west-1). Borrower documents are stored in private Supabase Storage buckets; public branding assets, such as lender logos, are separate.

This is the location of our primary storage. Email and document-analysis providers may process information outside that region. It is not a promise of US-only processing across every service provider.

Supabase provides TLS encryption for uploads, downloads, and project API traffic, and AES-256 encryption for hosted customer data at rest. These controls protect data while it travels and on the storage infrastructure. Stored mailbox authorization credentials are also encrypted by Borrova using AES-256-GCM. See Supabase’s security documentation.

Database row-level security and server-side checks control access to lender records. Document-workspace access is checked against the user’s authorized lender or administrative role, or the borrower’s private request link. Document-viewing links issued by that workspace expire after five minutes; the borrower request link is separate and can remain active longer. Treat both as confidential.

Borrova’s backend services and people with privileged administrative access can access documents to operate the service, provide support, investigate issues, or meet legal obligations. Encryption is managed by the infrastructure provider.

For borrower statements signed through Borrova, we save SHA-256 fingerprints of the exact signed content and generated PDF. The evidence includes the typed signer name, request recipient email, consent text, signing timestamp, available request and review history, and proxy-reported IP address when available. Database controls reject updates to the saved statement certificate and review records.

Hashes support comparisons to detect changed content; they do not encrypt files or independently verify who signed. This evidence applies to Borrova’s borrower-statement workflow, not every uploaded document or every action in the system.

Supabase reports a SOC 2 Type II audit of its services. This is assurance about our infrastructure provider, not a SOC 2 certification or independent audit of Borrova. We do not claim that using Borrova automatically satisfies your organization’s regulatory or electronic-signature obligations.

The Privacy Policy explains data use, service providers, retention, and deletion requests. Archiving is not deletion. Keep copies of records required by your organization’s retention rules. For security questions or suspected unauthorized access, contact support@borrova.app. Do not include borrower documents or sensitive identifiers in your initial email.