Security Overview

This overview describes the security controls protecting the Service, grouped by the control families used in ISO 27001 and SOC 2. Our program is modeled on and aligned with those frameworks; we make no certification claim. Each control below reflects a capability that exists in the product today.

Access control

• Supabase Postgres Row-Level Security scopes every host to their own account and properties.
• Guests are not database users; guest reads/writes are explicitly scoped by property and stay.
• The service-role key is server-only and never exposed to the browser.

Encryption

• All traffic is served over TLS.
• Data at rest is encrypted by our database and hosting providers.
• Guest contact identifiers are stored as irreversible hashes, not plaintext.

Data protection & AI routing

• PII redaction is applied to content before it is sent to any external model router (lib/ai/redaction.ts).
• Model requests are routed through the OpenRouter gateway; we request Zero-Data-Retention and opt out of provider model training. See the AI Disclosure & Use Policy for the current model-per-task register.
• Payment card data is handled solely by Stripe (PCI-DSS) and never stored by us.

Logging & monitoring

• Application errors and traces are captured in Sentry.
• Our logger redacts secrets, tokens, emails, and long digit sequences before output.
• Security-relevant actions are recorded in an append-only audit log.

Vulnerability management

• Dependencies are tracked and updated; the platform runs on managed, patched infrastructure (Vercel, Supabase).
• Cloudflare Turnstile mitigates automated abuse on guest verification.

Incident response

We maintain internal runbooks for security incidents and, as a processor, commit to 72-hour breach notification to affected controllers (see the DPA).

Vendor management

Subprocessors are engaged under data-processing agreements and listed on our Subprocessors page.

Certifications & assurance

Every control described on this page reflects a capability that exists in the product today. We do not currently hold a SOC 2, ISO 27001, or comparable third-party certification, and we make no third-party audit or penetration-test assurance. Where we describe a control as aligned with a framework, we mean our program is modeled on that framework’s control families — not that it has been independently attested. If you require a certification or completed security questionnaire, contact us via Support & Data Rights and we will tell you honestly what we can and cannot provide.