What we have. What we don't yet.

Encryption in transit and at rest.

TLS 1.3 for all data movement. AES-256 at rest across Supabase Postgres and Cloudflare R2. Standard cloud-grade encryption, configured and verified.

Row-level security on the database.

Every Postgres table is protected by Supabase RLS policies. Facilitator data is reachable only by the facilitator who owns it. Worker-mediated access for participant flows; no client-side privileged queries.

Worker access broker on every image request.

Image URLs are signed and short-lived. Each request passes through a Cloudflare Worker that validates a Supabase JWT (subscribers) or a session-scoped token (single-session buyers). No public deck images.

Single-region US hosting.

Supabase US-East and Cloudflare global edge. Data residency is bounded to a single jurisdiction for legal clarity, accepting the latency trade-off for international users.

Image-protection conventions on the client.

Deck images disable drag, save, and right-click in the browser. This is friction, not DRM. Determined users can still inspect element; the protection signals the covenant, doesn't enforce it.

Public subprocessor list, quarterly re-verified.

Every vendor with access to data is named publicly. Training-off configurations are verified every 90 days; the verification log is timestamped and published. Material changes notify subscribers by email.

SOC 2 certification.

No SOC 2 Type I or Type II report. The audit cost is meaningful for a small operation; we'll pursue it when customer demand or institutional sales make the case. We name the gap rather than imply we have what we don't.

ISO 27001 certification.

Same posture as SOC 2. No certification, no audit underway. The substantive controls (encryption, access management, subprocessor discipline) are in place; the formal certification process is not.

Third-party penetration test.

Pre-launch pen-test is scoped and planned, not yet completed. Once done, the high-level summary will be published; full report stays internal.

Twenty-four-seven security operations center.

No 24/7 SOC. Incident response is on-call by the operator. Materially affected customers are notified per the breach-disclosure policy.

Bug bounty program.

Not yet active. Planned once subscriber count justifies operational cost. Responsible-disclosure email is open in the meantime; see closing.

Pre-launch penetration test, published summary.

Scoped against the Worker access broker, Supabase RLS policies, and the Paddle checkout integration. Findings remediated before /pricing covenant ships; high-level summary appears here on completion.

Annual security review cadence.

Once a year, a written review of controls, incidents, and configuration changes. Published as part of the transparency report.

Bug bounty when scale justifies it.

A small reward program through an established platform once the customer base supports it. Until then, responsible-disclosure email below.