How Summit Spend protects your data
Encryption, bank connections, access control, audit logging, where your data lives and what happens when you leave.
Is my data encrypted?
Yes. Traffic to Summit Spend uses TLS 1.2 or newer. Data is encrypted at rest with AES-256 by our database and storage providers. Credentials for your integrations, like Sage Intacct, are encrypted again with a key held in a secrets vault.
Does Summit see my bank password?
No. Bank connections go through Plaid, and you sign in to your bank in Plaid's window. Summit never stores your bank credentials; Plaid holds them. Plaid maintains SOC 2 Type II compliance.
How do accounting connections sign in?
Sage Intacct and QuickBooks Online (beta) connect with OAuth 2.0. The tokens those connections use are stored encrypted.
Who in my company can see what?
Access follows roles. There are three built-in roles, Admin, Manager and Member, and Professional plans and up can make custom roles. New people join as Members, the most limited role, unless an admin picks another. See Invite people and choose roles.
Can other companies see our data?
No. Each company's data is kept apart in the database itself, so one company can never read another's.
Is there a record of who changed what?
Yes. Changes to transactions, receipts, expense reports, approvals, vendors and coding rules go into an audit log that shows who changed what and when. Entries can't be edited or deleted one by one, and the log can be searched and exported to CSV. Find it in Settings > Audit log. The audit log is included on the Professional plan and up.
Where is our data stored?
In US regions. Summit Spend runs on AWS, with Supabase Postgres for the database and Stytch for sign-in. Those providers are SOC 2 audited. Summit Spend itself doesn't have a SOC 2 report yet.
How long do you keep our records?
Financial records are kept for 7 years for regulatory compliance. If your account ends, you have 30 days to export your data.
Can I require two-factor sign-in?
Yes. See Sign in and two-factor verification.
Who do I talk to about a security review?
Email security@summitspend.com. For data access or deletion requests, email privacy@summitspend.com.