Security practices for your business data

1. How We Approach Security

We use layered application, infrastructure, and operational controls. Their purpose is to reduce risk, limit access, detect problems, and support a measured response when something goes wrong.

• Tenant boundaries: authorization checks and database policies protect workspace-scoped data where applicable.
• Least privilege: production access is limited to people and systems with a business need.
• Engineering controls: automated checks, code review, dependency review, and release gates are part of delivery.
• Operational visibility: service health, errors, and relevant security events are logged and monitored; coverage varies by service and event type.

2. Data in Transit and at Rest

• In transit: public web and API traffic uses HTTPS and transport-layer encryption.
• At rest: our primary hosting and data providers apply provider-managed encryption to hosted data. Exact controls depend on the service and its configuration.
• Secrets: production credentials and service secrets are kept outside application source and restricted to the workloads that require them.

Provider references: Google Cloud encryption at rest and Supabase security documentation.

3. Production service providers

• Google Cloud: production application workloads and delivery run on Google Cloud.
• Supabase: managed PostgreSQL and authentication support the product, with row-level security used for tenant-bound data where configured.
• Stripe: payment processing is delegated to Stripe; Sophosic does not store full card details.
• Backups and recovery: managed-service backup and recovery controls are used according to the capability and configuration of each data service.

A provider's certification or audit covers that provider's controls. It does not certify Sophosic as a whole.

4. Account access and permissions

• User identity: Supabase Auth provides account and session infrastructure; application authorization determines what an authenticated user can access.
• Workspace isolation: access checks are tied to the relevant user, workspace, and role rather than authentication alone.
• Privileged access: administrative access is restricted and reviewed according to operational need.
• Logging: relevant authentication, application, and infrastructure events are retained according to their operational, security, and legal purpose.

5. Report a security vulnerability

If you believe you found a vulnerability, send the affected URL or component, reproduction steps, and potential impact to [email protected]. Please do not access, alter, or retain data that is not yours. We do not currently advertise a public bug-bounty program or guaranteed response SLA.

6. Certification status

Sophosic does not currently claim SOC 2, ISO 27001, or HIPAA certification. Privacy rights under laws such as the GDPR or CCPA are legal obligations and user rights, not product certifications. See our compliance information for current scope and contact us before relying on a particular certification or regulated-use requirement.

7. How we handle security incidents

Our incident process covers triage, containment, investigation, recovery, and review. If an incident requires notice, we will communicate with affected parties as required by applicable law and the circumstances of the event.

8. Contact

Security reports: [email protected]. General questions can be sent through our contact page.