Your records are encrypted, private, and backed up.
You’re trusting SubLien with your subs’ certificates, W-9s, and signed waivers. Here’s how they’re protected and who can see them — in plain English, with the honest limits stated.
Any other SubLien staff account needs your approval. That’s the request on the right.
“Your ticket #218 — the waiver email to Summit Roofing bounced. I need to see the delivery log on that send.”
Four things that are always true
Encrypted between you and SubLien
Customer data and uploaded documents are encrypted while traveling between a browser and SubLien and while stored. Emailed copies are encrypted on their way to the recipient's mail server when that server supports encryption.
Your files stay private
COIs, W-9s, and waivers are kept private and available only through their dedicated workflows.
Backups live somewhere else
Recovery copies are kept with separate providers, so a problem with one company does not take out every copy.
You decide who gets in
SubLien support is an administrator of your workspace, and we remove it if you ask. Any other SubLien staff account has to ask first, and your owner or administrator decides.
Where your data and backups live
Well-known providers: your working data stays with Vercel and Neon. Recovery copies are kept at Supabase and Cloudflare R2, and the encrypted database backup also in Vercel Blob.
- Vercel
- Runs the application, stores your uploaded files in private storage (Vercel Blob), and keeps a copy of the encrypted database backup there.
- Neon
- Holds the primary database — your vendors, projects, waiver and COI records.
- Supabase
- Keeps a recovery copy of the database, refreshed daily.
- Cloudflare R2
- Stores separately encrypted backups of the database and your documents.
Can SubLien staff see my account?
SubLien support is an administrator of every workspace, so we can help when you ask.
Support is in every workspace
support@sublien.com is an administrator of every workspace, so we can set things up or fix them when you ask. It receives none of your notification emails.
Some acts stay yours
It cannot record your SubLien library approval, sign documents for your company, or become the owner.
Everything is under its own name
Every record the support account writes carries its own identity. Nobody at SubLien signs in as one of your users.
What your IT person will ask
Answers you can paste into a vendor-security questionnaire. If theirs isn't here, email us.
Does SubLien have a SOC 2 report?
No — Sublien LLC holds no SOC 2 or ISO certification of its own, and we would rather tell you that than imply otherwise. Vercel and Neon, the infrastructure the product runs on, each hold their own SOC 2 Type II reports; a questionnaire answer should name whose report it is.
Is our data used to train AI models?
No. Uploaded COIs go through Vercel AI Gateway, with zero data retention requested, to AI models from Anthropic and OpenAI, which read the fields for your team to review and answer the questions you ask about a certificate. The same providers also help read vendor spreadsheets imported without a usable header row and triage application errors. Customer documents are not used to train AI models. W-9s are not sent to any AI provider.
What other companies touch our data?
Resend delivers email, Stripe handles billing, and Cloudflare helps block automated abuse on public forms. The complete provider list, with retention and deletion details, is in the Privacy Policy.
Would we know if a signed waiver changed after signing?
SubLien records signing events and creates document hashes that help show whether a stored lien-waiver record changed later. These records support review; they do not decide legal validity, signer authority, or whether a payment should be released. Anyone with the signed PDF, or the SHA-256 fingerprint on its signing certificate, can check it at sublien.com/verify.
Where do passwords and files actually sit?
Uploaded files sit in private storage in Vercel Blob, never a public file area, and passwords are stored as protected hashes. The encrypted database backup is kept in Vercel Blob and Cloudflare R2, the encrypted file archive in Cloudflare R2, and a recovery copy of the database, refreshed daily, at Supabase.
Can we require two-step sign-in?
Yes. Each person can add a second step after their password: a code from an authenticator app, a code sent by email, or a passkey on the website, with single-use recovery codes as a backup. An owner or administrator can require it for everyone in the company, and can reset it for a teammate who loses their phone.
Ask us directly.
Any security question this page doesn't answer — email us and a person will reply.