Why We Moved Monk From Vercel/Supabase to AWS

We recently moved Monk's backend from Vercel and Supabase to AWS, for more control over reliability and performance, and full control over where our customers' financial data lives and is processed. This post covers what changed, why we did it, and what it means for the security of your data.

Why we made the move

On every invoice, Monk runs continuous work in the background: following up over email and voice, processing payments, resolving disputes, and running playbooks. As that work grew, we wanted infrastructure we own end to end, so we can tune reliability and performance ourselves and decide exactly where customer data lives.

We moved the long-running side of that work onto a dedicated workflow engine earlier this year, which we wrote about in why we moved 100 workflows to Temporal. This move is the next step: the data itself.

What changed

We moved compute and data to AWS. Our services run in containers, with application data in Aurora and S3, infrastructure defined in code so every change is reviewed and reproducible, and monitoring wired across the stack so we catch issues early.

Two things this gives us:

• Customer data now lives inside our own AWS environment, which gives us direct control over how it is secured, isolated, and kept compliant.
• Room to scale as the product grows, without working around the limits of a platform built for a different kind of workload.

Why this matters for your data security

Owning our cloud environment is what lets us keep your data secure. We control where it lives, how it is isolated, and who can reach it. Every customer's data is scoped to their organization, so one customer can never see another's. Access is role-based and reviewed, data is encrypted, and we hold to a defined retention policy, with production data never used in development or testing. Every action the platform takes lands on an audit trail you can inspect.

Your data also stays on a private network. It never travels across the public internet, and the parts of our system that hold financial data sit in their own closed-off section that nothing on the outside can reach directly.

Our compliance posture

Monk is SOC 2 Type II, and we monitor those controls continuously rather than treating compliance as a once-a-year event. We are extending our program toward ISO 27001. Independent review is part of how we hold ourselves to this standard.

What did not change

Your data is yours. It runs the agents that work your receivables, and nothing else. This migration was about running that work on infrastructure we control and can secure, without changing who owns the data or what it is used for.

What is next

Owning our environment gives us room to keep hardening reliability and observability, and to keep raising our security standards as we grow. If your security or IT team wants to go deeper, we are happy to walk through our architecture and controls directly.

Frequently asked questions

Why did Monk move from Vercel and Supabase to AWS?

For more control over reliability and performance, control over where customer financial data lives, and room to scale. Owning the environment lets us secure and isolate data ourselves instead of depending on a platform built for a different workload.

Where does Monk's data live now?

In Monk's own AWS environment, where each customer's data is isolated to their organization, encrypted, access-controlled, and held to a defined retention policy.

Does my data travel over the public internet?

No. Your data stays on a private network and never crosses the public internet, and the parts of our system that hold financial data sit in their own closed-off section that nothing outside can reach directly.

Is Monk SOC 2 compliant?

Yes. Monk is SOC 2 Type II and monitors those controls continuously, and is extending its program toward ISO 27001.

Is my data used to train AI models?

No. Your data runs the agents that work your receivables. It is not used to train models, and it is not the product.

Did the migration affect customers?

No customer action was required. Traffic moved off the old platform cleanly, with the change happening behind the scenes.