Castford applies zero trust principles to every data interaction — whether your team connects via our integration portal or uploads files manually. No implicit trust. Every request authenticated. Every byte encrypted.
SOC 2 Ready · GDPR compliant · SOX 404 ready
Compliance & Certifications
Every data interaction within Castford follows six core zero trust principles. No user, device, or system is implicitly trusted — regardless of whether it sits inside or outside the network perimeter.
Every user and service account is authenticated before accessing any resource. Multi-factor authentication (MFA) is enforced for all human users. Service-to-service calls use short-lived, automatically rotated credentials — never static API keys.
Users and integrations receive only the minimum permissions required for their role. A VP of Finance sees consolidated reports; a department analyst sees only their cost center. Connector service accounts are scoped to read-only access by default.
All data is encrypted in transit using TLS 1.3 and at rest using AES-256. Encryption keys are managed through a dedicated key management service with automatic rotation every 90 days. Customer data and key material are never stored in the same system.
Every system component is designed as if neighboring components may already be compromised. Micro-segmentation isolates customer data environments. Lateral movement is blocked by default — even internal services must authenticate to access data stores.
Every access event is logged and analyzed in real time. Anomalous patterns — such as a user querying data outside their normal scope, or a connector pulling an unusual volume — trigger automated alerts and can suspend access within seconds.
Every data access, transformation, and export is recorded in a tamper-proof audit log. These logs are retained for 7 years and can be exported for SOX compliance audits, internal investigations, or regulatory review at any time.
Whether your team connects through our integration portal or uploads files manually, every piece of financial data follows the same zero trust pipeline from the moment it enters Castford.
When a customer connects their ERP, CRM, HRIS, or billing system through the Castford connector portal, the following happens:
When a customer uploads financial data manually (CSV, Excel, PDF), the file goes through the same zero trust pipeline:
Every stage of the data lifecycle is governed by zero trust controls. Here is exactly what happens to customer financial data inside Castford.
Data enters through connector sync or manual upload. Encrypted in transit via TLS 1.3. Authenticated session required. Schema validated before acceptance.
AES-256 in transit -- OAuth 2.0 or session token authData is written with Row-Level Security (RLS) enforced on every query. Tenant isolation is guaranteed at the Postgres database layer — every query is scoped to the authenticated customer's organization ID.
Postgres RLS enforcement -- tenant_id scoping on every queryFinancial models, AI analysis, variance detection, and forecasting operate within the customer's RLS-enforced context. The AI layer (Anthropic Claude API) receives only the specific data needed for the current query — no persistent access, no cross-tenant visibility.
Anthropic Claude API -- per-query data scopingProcessed data is encrypted at rest with AES-256, managed by Supabase's infrastructure encryption. Customer-managed keys (BYOK) are on the enterprise roadmap for 2026.
AES-256 at rest -- Supabase-managed encryptionEvery query, report, export, and API call is authenticated and authorized against the user's role and permissions. Sensitive operations (bulk export, admin changes) require re-authentication. All access events are logged.
Role-based access control -- re-auth for sensitive operationsCustomers control their data retention policy. When a customer requests deletion, all data — including backups, derived models, and cached results — is cryptographically erased within 30 days. A certificate of destruction is issued upon completion.
Customer-controlled retention -- 30-day crypto-erasure -- destruction certificate| Data State | Method | Standard | Key Management |
|---|---|---|---|
| In transit (connector sync) | TLS 1.3 | AEAD cipher suites only | Certificate pinning, automatic renewal |
| In transit (manual upload) | TLS 1.3 | AEAD cipher suites only | Certificate pinning, automatic renewal |
| In transit (API calls) | TLS 1.3 | AEAD cipher suites | JWT-based authentication |
| At rest (primary storage) | AES-256-GCM | Industry-standard AEAD | Supabase-managed encryption |
| At rest (backups) | AES-256-GCM | Industry-standard AEAD | Separate backup encryption key |
| At rest (audit logs) | AES-256-GCM | Immutable, append-only | Separate audit key, 7-year retention |
| Secrets (OAuth tokens, API keys) | AES-256 envelope | Isolated secrets vault | Automatic rotation, never in application DB |
Castford is designed for finance teams operating under SOX, GDPR, CCPA, HIPAA, and industry-specific regulatory requirements.
Continuous control monitoring, segregation of duties enforcement, immutable audit trails, and one-click evidence export for internal and external auditors. Designed for public company finance teams.
Right to access, right to erasure, data portability, and processing records. Data residency options for EU customers. Data Processing Agreement (DPA) available for all customers.
Annual third-party audit covering security, availability, processing integrity, confidentiality, and privacy. Audit report available to customers and prospects under NDA.
Do-not-sell compliance, consumer data access requests, and deletion workflows. Applicable to customers operating in California or processing California resident data.
Business Associate Agreement available for healthcare and life sciences customers. PHI-specific controls, access restrictions, and breach notification procedures.
Certified information security management system covering risk assessment, access control, incident management, and business continuity planning.
Castford never sells, shares, or uses customer data to train AI models. Your financial data is yours — and you can export or delete it at any time.
Your financial data belongs to you. Castford acts as a data processor, never a data owner. We process your data solely to provide the services you've contracted for.
Castford uses Anthropic's Claude API for AI capabilities. Anthropic's data policy guarantees API inputs are never used for model training. No training on your financial data, ever.
When you request deletion, all data — primary storage, backups, derived models, cached results, and audit logs beyond regulatory minimums — is cryptographically erased within 30 calendar days.
Request a security review with our trust team. We'll walk through our zero trust architecture, compliance certifications, and data handling practices.
Available to qualified prospects under NDA