Security

Data at rest

• Facility, tank, and intake data live in Supabase Postgres, encrypted at rest.
• Tank and containment photos and generated PDFs live in access-controlled Supabase Storage. The buckets are not publicly readable.
• Files are served through short-lived signed URLs. After expiry, the URL stops working and a new one must be minted from your account.

Data in transit

All traffic is encrypted with TLS. Data moves between your browser, our application, and Supabase over HTTPS only.

Payments

Stripe handles all payment data. We never see, store, or log card numbers. Our database only holds Stripe’s payment and customer identifiers.

Compliance scope

We are not SOC 2 certified and we are not a HIPAA covered entity. SPCC plan data is not protected health information. If your organization requires a SOC 2 vendor for plan storage, this product is not a fit.

Reporting a vulnerability

Email contact@athanorworks.com with details. We respond within 3 business days.