MarkPaid is designed to protect customer data, keep each account isolated, and preserve a traceable record of sensitive activity. This page summarizes the controls we use today and the assurance work still in progress.
Security controls
Our controls layer technical safeguards with documented operating practices. We publish enough detail to support customer diligence without exposing sensitive configurations or procedures.
Customer-facing traffic and authenticated integrations use encrypted connections. Production data uses provider-supported encryption at rest, while credentials and secrets are restricted to authorized server-side paths and excluded from application logs.
Customer data is scoped by account. Authentication, role- and account-based authorization, and database Row Level Security work together to limit access. Privileged support access is server-only, time-boxed, and recorded in an audit log.
MarkPaid runs on managed cloud hosting, authentication, database, and workflow platforms. We remain responsible for secure configuration, access, tenant isolation, monitoring, incident response, and ongoing vendor review.
Changes are reviewed through pull requests, tested in separated development or preview environments, and approved before production deployment. Automated dependency, security, and business-invariant checks support each release, with deployment history available for rollback.
Availability, application errors, workflows, database connectivity, and relevant integrations are monitored. A documented incident-response process covers reporting, triage, investigation, containment, recovery, documentation, and required notifications.
MarkPaid has completed an external penetration test. Detailed findings and other sensitive security evidence are shared through controlled review channels when appropriate, rather than published in a way that could weaken the service.
Product security
Security is part of how changes move from development into production, with reviewable evidence retained in source control and deployment history.
Governance
Security and compliance practices have named ownership and recurring review cycles so published commitments can stay aligned with the system we operate.
Bspoke Ventures Inc. is preparing MarkPaid for a SOC 2 Type 1 point-in-time examination. The formal examination has not begun, and no SOC 2 report has been issued.
MarkPaid does not currently claim a SOC 2 attestation, and a Type 2 examination period has not been completed. Readiness work includes formalizing controls, collecting evidence, testing safeguards, and maintaining security and privacy documentation.
Our privacy program is designed to support applicable Canadian privacy obligations, including PIPEDA and Quebec’s private-sector privacy law. See our Privacy Policy for details.
Contact our security team for procurement reviews, controlled evidence requests, or vulnerability reports. Please do not include credentials or sensitive customer or financial data in your first email.
Security researchers can also review our security.txt.