Your workspace stays separate.
Your people work in their own workspace. People from another organisation cannot see your records.
Security
Boring, reliable defaults.
Practical protections designed to keep your client work private, available, and under your control.
Private by defaultShare only what each client needs
SeparatedEvery workspace stays isolated
VerifiedPayment status follows confirmation
Workspace boundaryControls active
Private by default
Workspace isolationRole accessEncrypted transitRecovery backupsHow your data is protected
Ten things worth knowing.
The defaults are designed around isolation, explicit access, confirmed financial events, and recoverable operations.
Files are private by default.
You decide which client or project can access each document, and shared links expire automatically.
Sign in with Google. No passwords to remember.
Northline Ops does not ask you to create or share a separate password.
The right access for each person.
Owners, administrators, team members, and clients each see the information appropriate to their role. Clients only see the work you share with them.
Payments go through Stripe and Razorpay directly.
Northline never sees or stores card details. Payment providers handle checkout directly, and a payment is recorded only after confirmation.
Repeated payment notices stay safe.
If a payment provider sends a confirmation more than once, Northline handles it safely so invoices are not updated twice.
Protection against misuse.
Sign-in, invitations, document sharing, payments, imports, and exports have safeguards designed to prevent misuse.
Recurring cycles do not create duplicate invoices.
If a payment or billing update is repeated, it is processed only once, so invoices stay accurate.
Your information is protected.
Your information is protected when stored and sent between your browser, Northline Ops, and payment providers.
Boring, reliable operations.
Northline maintains backups for recovery, reviews changes before release, and investigates issues without relying on unnecessary personal information.
Who touches your data
Our service providers.
Northline works with six providers and publishes what each one does for the service.
Supabase
Sign-in and data storage
United StatesCloudflare R2
Document storage
Global · nearest edgeVercel
Website hosting
United States / Europe · edgeStripe
International payments
United States / EuropeRazorpay
Payments in India
IndiaOneSignal
Browser push, opt-in only
United StatesThese providers hold their own independent attestations. Northline Ops does not claim SOC 2, HIPAA, or GDPR certification for the service itself. See the current sub-processors list.
Your part
Security is shared.
Strong defaults work best with a small set of deliberate habits on your side.
- Turn on two-step verification on the Google account you sign in with.
- Invite only people who need access, and remove access when someone leaves.
- Set milestone and document visibility to Client only when you want the client to see them.
- Report anything suspicious to security@northlineops.com. Every report is treated as a top priority.
Transparency
Incident visibility.
Operational information and clear response targets stay visible when something needs attention.
Operational status.
Real-time operational status, uptime history, and incident postmortems, with email or RSS subscriptions available at status.northlineops.com.
Critical means priority.
Email support responds within 24 hours. Critical issues such as data loss or security concerns target a response within 4 hours.
Report an issue
Something looks off?
Email security@northlineops.com with a description and, if you can, steps to reproduce. Security reports receive top priority.
Email security