Security
Last updated: August 31, 2026
Overview
Gordon stores sales commission and compensation data, so we treat security as core to the product, not an afterthought. This page describes the technical safeguards in place today, written plainly so a security reviewer can evaluate Gordon without a sales conversation. If you need more detail or a completed questionnaire, reach us at hello@trygordon.io.
Infrastructure
- Application hosting: Vercel.
- Database: Supabase (managed PostgreSQL, running on AWS infrastructure).
- All traffic between clients and Gordon is encrypted in transit via TLS.
- Data at rest is encrypted using Supabase’s default encryption for its underlying PostgreSQL storage.
Data Isolation & Access Control
- Per-organization isolation. PostgreSQL Row-Level Security (RLS) policies enforce data isolation at the database layer, so one company’s compensation and commission data is not reachable from another organization’s session — this is enforced by the database itself, not only application code.
- Admin authentication. Sign-in supports Google OAuth in addition to standard email/password credentials.
- Support access. A superadmin impersonation capability exists solely for customer support. It is session-scoped, and every impersonation session is logged to an audit table recording who accessed which organization and when.
Credential & Secrets Handling
OAuth tokens for third-party integrations (CRM connections, Slack) are encrypted at the application layer before they are stored — they are never persisted in plaintext.
Payment Data
All billing is handled by Stripe. Gordon does not store or otherwise touch raw card numbers at any point in the payment flow.
Data Retention & Deletion
Organization data can be fully deleted on request, including associated authentication records. See our Privacy Policy for the default retention schedule.
Compliance Status
Gordon does not currently hold a formal SOC 2 or ISO 27001 certification. We’d rather say that plainly than overstate our posture. We’re glad to complete a security questionnaire, sign a data processing agreement, or scope a pilot’s data access narrowly to fit your requirements.
Reporting a Vulnerability
If you believe you’ve found a security issue in Gordon, please report it to hello@trygordon.io. We’ll respond as quickly as we can.