How we protect your data

DueLantern runs on well-known providers that are independently audited. We don’t run our own servers.

• Vercel hosts the app. Vercel is SOC 2 Type 2 audited.
• Supabase stores your data and documents. Supabase is SOC 2 Type 2 audited.
• Stripe handles payments. Stripe is a PCI DSS Level 1 service provider, the highest level for card payments.

These audits cover our providers, not DueLantern itself. DueLantern is a small company and does not have its own SOC 2 report.

• Everything sent between your browser and DueLantern is encrypted with HTTPS (TLS).
• Your data and uploaded files are encrypted at rest by our database provider.

• Every record is tied to your company. Database rules (row-level security) stop one company from ever seeing another company’s data.
• Only people you invite to your team can log in to your account. You can remove them anytime.
• Uploaded documents are kept in private storage, never on a public web address. When you open one, we create a link that expires within minutes.

• Employees upload renewals through a private link that only works for their own requirement. They can’t see anyone else’s documents.
• Uploads go into a review queue. Nothing replaces an existing document until someone on your team approves it.
• Files are limited to PDFs and photos (JPG, PNG, WEBP, HEIC) up to 10 MB.

• Compliance packet links always expire (after 1, 7, 30 or 90 days) and can be turned off anytime.
• Documents are not included unless you choose to include them.
• Every time a link is opened, it shows up in your Activity log.

DueLantern records who added, changed, approved or deleted what, and when. You can view it anytime and download it as a spreadsheet.

• Logins are handled by Supabase Auth. Passwords are stored as secure one-way hashes, never as plain text. You can also sign in with Google.
• Card details go straight to Stripe. They never touch DueLantern’s servers.

When you upload a document, it’s sent to OpenAI’s API so the expiration date can be read automatically. Under OpenAI’s published API policy, this data is not used to train their models. A person on your team always confirms the date before it’s saved.

DueLantern is built for licenses, certifications, insurance certificates, permits and similar documents. For health-related requirements, upload the clearance card or certificate (for example, “TB test: cleared” or a vaccination card), not medical records or test results. DueLantern is not a HIPAA-compliant medical records system.

• Export your requirements, employees and activity log as spreadsheets anytime.
• You can delete your account and all of its data from Export & delete in the app.
• See our Privacy Policy for how long data is kept.

If you think you’ve found a security problem, please email support@duelantern.com with “Security report” in the subject. We’ll respond as quickly as we can.