Security & trust
Your records sit in their own database, and row-level security guards every table in it, so no other business we build for can reach them. TLS encrypts every byte on its way there, and AES-256 encrypts it once it lands. Stripe takes the card numbers. We never hold them. Every price is recomputed on our server before a charge, and every sensitive action lands in an audit log you can read.
Payments run through Stripe. Your data lives in Supabase, behind row-level security on every table.
None of this is an add-on or an upgrade. Here's exactly what protects your money and your customers' records.
Your system runs in its own private database, not a shared table with somebody else's business bolted on. No other client's system can reach your data: not another company, not a shared server, not us by accident.
Everything moves over the same encrypted connection your bank uses (TLS, the padlock in the browser bar), and it stays encrypted once it lands in storage (AES-256). In transit and at rest, never in the clear.
Every dollar is verified on the server, so the browser is never trusted with a price. And if a checkout gets interrupted, nothing is lost and nothing is stuck: the customer picks up right where they left off.
Stripe handles card numbers directly, certified to the highest level of payment security there is (PCI Level 1). That keeps your business in the lightest, safest tier of payment compliance.
Every action that matters is written to a permanent, tamper-evident record: who did what, and when. A paper trail you can always pull, that nobody can quietly edit.
Everything sits on Stripe, Supabase and Vercel. Stripe holds PCI Service Provider Level 1 certification, and Supabase is certified to SOC 2 Type 2 and ISO 27001.