Security

Identity + access

Authentication via Supabase Auth (email OTP + magic link). Sessions are HttpOnly cookies with 7-day expiry and lazy refresh. Tenant boundaries enforced at the database row-level (RLS) and at the application provider layer.

Data at rest

Postgres encrypted at rest. Backups daily with 30-day retention. PII hashed at ingest. Stripe billing data never touches our Postgres beyond the customer + subscription IDs.

Data in transit

TLS 1.2+ everywhere. HSTS enabled. Cloudflare-managed SSL on every property subdomain we provision.

Webhook security

Stripe webhook signatures verified on every event. Internal job endpoints require x-vero-job-token header HMAC-compared against env.

Compliance roadmap

SOC 2 Type I attestation begins Q3 2026; CCPA + GDPR opt-out endpoints live today at /privacy/request.

Reporting an issue

Email security@onvero.io with a description and reproduction steps.