How your data is protected
Isolation enforced by the database
Every table is guarded by Postgres row-level security — who can see what is decided by the database itself, on every query, not by application code that could have a bug.
Encryption everywhere
TLS for everything in transit; AES-256 encryption at rest across the database and file storage.
Calendar keys never touch your browser
The tokens that connect your Google or Microsoft calendar live in a server-side vault table that no browser session can read — connections work without your keys ever being exposed.
Private files, expiring links
Project attachments sit in private storage visible only to project members, served through short-lived signed URLs — never public buckets.
Roles with real teeth
Owner, admin, and teammate permissions are enforced at the database layer. Removing someone's seat revokes their access and shares immediately.
Locked-down operations
Two-factor authentication on every administrative console, secrets confined to encrypted server-side stores, hardened browser security headers, and a documented, rehearsed incident-response runbook.
Certified infrastructure
Supabase — database, authentication, and storage. Independently audited annually.
Netlify — application hosting and global delivery, with yearly third-party penetration testing.
Application data is hosted in a single, fixed Supabase region and stays there. We never sell personal data, never run advertising, and never train AI models on your content.
Subprocessors
| Provider | Purpose | Location |
|---|---|---|
| Supabase (on AWS) | Database, authentication, file storage, server functions | AWS · single fixed region |
| Netlify | Hosting and content delivery | Global edge |
| Postmark | Transactional email | US / EU |
| Google · Microsoft | Calendar sync — only when a user connects their account | Global |
This list changes only with notice. A data processing agreement is available to customers on request.
What's ahead
We publish what's true today and say plainly what's next:
- Two-factor authentication for user accounts
- Self-serve data export and account deletion
- Independent penetration testing
- SOC 2 certification at company level as we grow
Found something?
If you believe you've found a vulnerability, email security@calmerdaysahead.com with enough detail to reproduce it. We'll acknowledge within 2 business days, keep you informed as we fix it, and never take action against good-faith research.
Please don't access data that isn't yours or disrupt the service while testing.