Security & Data Protection
Security is not an afterthought — even though this is still a very small one-person project. Here’s what I do today to keep your data reasonably safe.
Authentication
Supabase Auth (email + password, secure tokens, refresh rotation, rate limiting). No social logins yet.
Row Level Security (RLS)
Every table uses RLS. Users can only see and modify data belonging to their company.
Encryption
Data in transit: TLS 1.3 everywhere. Data at rest: encrypted by Supabase (PostgreSQL). Sensitive fields (if any) are encrypted client-side where possible.
File Storage
Supabase Storage with signed URLs, public buckets avoided, file type & size restrictions.
Monitoring & Alerts
Login attempts, failed auth, suspicious activity logged. Basic alerting via email for critical events.
Current limitations
No formal SOC 2 yet, no bug bounty program, no external pentests (yet), single developer — so human error is the biggest risk right now.
- Short-term
Enable 2FA / passkeys (already supported by Supabase)
Will enforce for admin roles first, then optional for everyone.
- Medium-term
External security audit / penetration test
Once we have paying customers and meaningful data.
- Long-term
Bug bounty program
Invite ethical hackers to find issues with rewards.
SOC 2 / ISO 27001
Only when we have enterprise interest and budget.
If you discover any security vulnerability — even small — please report it responsibly. I take every report seriously.
Please do not post vulnerabilities publicly until I’ve had reasonable time to fix them. Thank you for helping keep this safe.
This page is intentionally straightforward because the product is still very early. Security will become more formal as we grow and take on paying customers.
Thanks for caring about security — it matters to me too.