Security

What is in place today, described precisely enough to be checked — and an honest list of what is not.

Tenant isolation

Every organisation is a separate workspace. Isolation is enforced by row-level security in Postgres, on every table, rather than by application code alone — so a query that forgets a filter returns nothing rather than somebody else’s data.

Credentials

• We never ask for or store a password to any social platform.
• Account connections are made through the network’s own authorisation flow and can be revoked by the person who made them.
• Provider tokens are held in columns that the browser-facing database role cannot read at all.

Joining a workspace

A workspace claims the email domains it owns, and an address at one of those domains is what admits you — there are no invite links to forward or leak. Supabase confirms the address before the account exists, so the domain is proven rather than asserted, and everyone who arrives this way gets the least-privileged role until an admin grants more.

Public mailbox providers are refused, so a personal address can never stand in for a company one.

Transport and headers

HSTS, a content security policy, and frame-ancestors restrictions are set on every response, API routes included. Incoming webhooks fail closed and compare their secrets in constant time, and both support rotation without downtime.

What we have not done

• We do not hold SOC 2, ISO 27001, or any other audit certification today.
• There is no bug bounty programme yet. Reports are still very welcome — see below.
• SSO / SAML is an enterprise conversation, not a self-serve feature.

Reporting something

If you have found a vulnerability, tell us through the contact page and mark it as a security report. Please give us a reasonable window to fix it before publishing.