Data Security & Governance Report
Version: 1.0 | Last Updated: January 2026 | Classification: Public
Security Controls
Infrastructure Security
Cloud Provider
Supabase (built on AWS infrastructure) with SOC 2 Type II certification
Data Encryption
AES-256 encryption at rest; TLS 1.3 encryption in transit
Network Isolation
Virtual Private Cloud (VPC) with isolated tenant environments
DDoS Protection
Enterprise-grade protection via Cloudflare and AWS Shield
Authentication & Access Control
| Control | Implementation |
|---|---|
| Authentication | JWT-based authentication with secure token management |
| Password Policy | Minimum 8 characters with complexity requirements; bcrypt hashing |
| Session Management | Configurable session timeouts with secure refresh token rotation |
| Role-Based Access | Granular permissions (Team Member, Administrator, Super Admin) |
Multi-Tenant Data Isolation
- Row-Level Security (RLS): PostgreSQL RLS policies enforce strict tenant isolation at the database level
- Auction-Based Segmentation: All core data tables include
auction_idforeign key with enforced RLS - Cross-Tenant Prevention: Database-level policies prevent any cross-tenant data access
Availability Controls
| Control | Implementation |
|---|---|
| Uptime SLA | 99.9% availability (Supabase Pro tier) |
| Database Backups | Daily automated backups with 7-day retention; point-in-time recovery |
| Disaster Recovery | Multi-region replication capabilities; RPO < 24 hours |
| Monitoring | Real-time health monitoring with Sentry error tracking |
Confidentiality Controls
Data Classification
| Data Type | Protection Level |
|---|---|
| User Data | Email, name, role assignments — encrypted at rest |
| Operational Data | Lot submissions, inspections, problem reports — tenant-isolated |
| Imported Data | Third-party historical data — same protections as native data |
Access Restrictions
- Service role keys restricted to server-side operations only
- Anonymous keys limited to authenticated user scope via RLS
- Admin functions require elevated role verification
- Audit logging for administrative actions
Data Handling
Data Retention
Data Retention
Data retained per customer agreement; deletion available upon request.
Data Export
Data Export
Authorized users can export their organization’s data via admin dashboard.
Data Deletion
Data Deletion
Cascade deletion policies ensure complete data removal when requested.
Processing Integrity
- Input Validation: Zod schema validation on all form inputs (mobile and admin)
- Type Safety: Full TypeScript coverage with strict compilation
- Database Constraints: Foreign keys, check constraints, and triggers enforce data integrity
- Optimistic Updates: Rollback mechanisms prevent partial data corruption
Third-Party Data Import Security
When importing historical data from external systems:1
Secure Transfer
Data imported via authenticated API endpoints or secure CSV upload
2
Validation
All imported records validated against schema before insertion
3
Tenant Assignment
Imported data automatically scoped to importing organization
4
Audit Trail
Import operations logged with timestamp and user attribution
Compliance Alignment
| Framework | Status |
|---|---|
| SOC 2 Type II | Infrastructure provider certified; application controls aligned |
| GDPR | Data minimization, right to deletion, export capabilities |
| CCPA | Consumer data rights supported |
Incident Response
1
Detection
Automated error monitoring via Sentry with real-time alerts
2
Response
Documented incident response procedures activated
3
Communication
Customer notification within 72 hours of confirmed breach
4
Remediation
Root cause analysis with preventive measures implemented
Contact
For security inquiries or to request additional documentation:Security Team
This document provides an overview of security controls. Detailed policies available upon request under NDA.