How Policy Stack Protects Your Data

Policy Stack uses row-level security at the database level. This is a PostgreSQL feature that ensures:

• You can only access your own data — no exceptions
• Every database query is filtered by your authenticated user ID
• Even if there were a bug in the application code, the database itself would reject unauthorized access
• There is no "admin override" that bypasses RLS

What this means in practice: Your policy data, snapshots, loan records, and deployment details are invisible to every other user in the system. The database enforces this, not just the application.

Authentication

Policy Stack supports two authentication methods:

Magic Link

• Enter your email address, receive a secure one-time link
• No password to remember, steal, or reuse
• Each link expires after use
• No credential storage risk

Google Sign-In

• Authenticate using your existing Google account
• Leverages Google's security infrastructure
• No separate password for Policy Stack

AI Data Handling

Policy Stack uses AI for features like the AI Assistant and AI Insights. Here is how your data is handled:

• AI processing happens on-demand when you use AI features
• Your data is sent to the AI model only for the specific request
• Your data is not stored by the AI provider after processing
• Your data is not used to train AI models
• AI features are opt-in — if you do not use them, your data is never sent to an AI model

No Third-Party Data Sharing

Policy Stack does not sell, share, or provide your data to third parties. Your data is used exclusively to provide the Policy Stack service to you.

Advisor Access (Builder Pro)

If you work with an advisor and grant them access:

• The permission level is disclosed when the relationship is created; sponsored seats use view-and-edit access, while some direct connections allow view-only
• You control access — you grant it and you can revoke it at any time
• Advisors see only the data you have authorized
• Access is logged

Account Deletion

If you choose to delete your account:

• In-app deletion immediately removes your consumer account and associated financial records from the active service
• Academy learner notes, questions, ratings, quiz attempts, certificates, progress, and learner listings are removed when deletion completes
• Academy purchase, refund, dispute, and payment-reconciliation records, with their linked enrollment, are retained for 7 years; course access ends when deletion completes
• Academy publisher owners must contact support to close their Academy before account deletion
• Limited legal, billing, fraud-prevention, security, and dispute records may be retained where required; backup copies expire through normal rotation
• Records separately created and controlled by an advisor may remain in that advisor's practice records
• Deletion is irreversible — once confirmed, the data cannot be recovered
• The account endpoint deletes immediately after its checks succeed; legacy deactivated accounts are purged after 30 days

Infrastructure

Policy Stack is built on:

• Supabase — enterprise-grade PostgreSQL database with built-in security features
• Vercel — secure hosting infrastructure with automatic SSL and DDoS protection
• Stripe — PCI-compliant payment processing (Policy Stack never sees or stores your credit card number)

Policy Stack is a tracking and visualization tool. It does not provide financial advice, recommendations, or opinions on what you should do with your banking system.

Policy Stack is independent of and is not affiliated with, sponsored by, or endorsed by Infinite Banking Concepts, LLC or the Nelson Nash Institute.