Security that stays out of your way.

Multi-factor authentication is required before anyone enters an organization workspace, the contractor portal, or administration.

Approving a pay run, initiating a payout, and transferring ownership each ask you to verify again, so a signed-in session alone can’t move money.

Design: Supabase Auth with MFA required before protected layouts load any data, and step-up verification (a higher assurance level) for sensitive actions. Sessions are held in secure server-side cookies.

Initiating a payout requires an explicit payout permission and a second verification step. Money movement stays separate from preparing a pay run.

Staff prepare and review pay runs with the permissions you grant. An authorized approver signs off. Organizations can require that a different person approves than the one who prepared the run.

Design: Four roles — Owner, Admin, Staff, and Read-only Auditor — with action-based permissions scoped to the whole organization or to specific divisions and teams. Optional four-eyes approval.

Every organization’s data is separated at the database. Your contractor list, pay runs, statements, and totals are visible only to people your organization has granted access.

Access is denied by default and granted by policy, not by what a screen happens to show.

Design: PostgreSQL row-level security enabled and forced on every table, deny by default, with positive and negative authorization tests for every material action. Server checks are defence in depth, never the only control.

Bank account numbers never touch Caliber’s database. Contractors enter identity and bank details in Stripe’s own onboarding.

Caliber keeps only Stripe account identifiers and payout status. Raw Social Security and tax identification numbers are never stored in Caliber’s database.

Design: Stripe-hosted onboarding for one connected account per contractor. Caliber stores provider references and readiness status only. Payout webhooks are signature-verified and processed idempotently.

Every financial and privileged action — creating, approving, or amending a pay run, and every payout instruction — records who acted, when, and what changed.

Approved records are never edited in place. A correction is a linked amendment, and the original stays visible.

Design: Append-only audit events in a hash-linked chain. Final retention periods are pending legal review; until then, financial records and audit evidence are retained.

Data is designed to be encrypted in transit and at rest, using the encryption Caliber’s infrastructure providers manage.

Statement files are designed to be stored privately and append-only: a new version never replaces an old file.

Design: Encrypted transport for every connection and provider-managed encryption at rest. Statement storage is private and never overwritten at the same path.