Security

One company cannot read another

Companies are isolated in Postgres with row-level security. A request for another company's row comes back empty from any path — the app, a guessed URL, or a raw API call.

Files

Every uploaded file lives in a private bucket and is served through a short-lived signed URL minted when you open it. There are no public storage paths. Files are encrypted at rest by our infrastructure provider.

Seats

Roles are owner, producer, lead, crew and driver. The difference between seats is what you may change.

Sign-in

Email and password, or Google as a sign-in method — not a company identity provider. We receive email, name and avatar from Google to create or link an account. We do not read Drive, Calendar or Contacts. Both methods run through Supabase Auth. There is no SSO or SAML.

Two-step verification

MFA is available for owners: an authenticator app, enrolled from your account settings, and an owner can require it of everyone in the company. An account holding a verified factor is asked for a code every time it signs in. The scope is the app — it is what admits a session — and not a condition re-checked on every database API call.

Where it runs

The app runs on Vercel; data lives in Supabase (Postgres); files are encrypted at rest by the provider.

Certifications

We do not claim SOC 2 or ISO certification today.

Reporting a vulnerability

Mail hello@phaseops.live with what you found and how to reproduce it. It is read by a person.