Security you can verify.

Security pillars

• Encryption everywhere

  All Customer Content is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher with modern cipher suites. Database backups and object storage are encrypted with managed keys rotated on the underlying provider's schedule.

• Hardened hosting

  Production workloads run on Cloudflare's global edge network and Supabase managed Postgres (AWS US regions, with EU residency available on enterprise plans). All providers maintain SOC 2 Type II and ISO 27001 attestations.

• Least-privilege access

  Employee access to production systems is gated by SSO with phishing-resistant MFA, scoped via role-based access control, audited continuously, and revoked within 24 hours of role change or termination.

• Defense in depth

  WAF, DDoS protection, bot mitigation, secret scanning, dependency scanning, static analysis, and runtime anomaly detection run on every commit and every request.

• Independent testing

  We engage a qualified third-party firm for an annual application and infrastructure penetration test. Continuous internal testing and bug-bounty-style researcher submissions supplement the annual engagement.

• Monitoring and response

  24x7 alerting on availability, error budgets, and security signals. Documented incident response playbooks with defined severity tiers, on-call rotation, and customer notification within 72 hours of confirmed personal-data breach.