Security
How we keep the software we build safe
This page doesn't list certifications we don't hold. It describes what we actually do on the projects we build, and how to reach us if you find a problem.
Access rules live in the database
Where an app uses Supabase or Postgres, we protect data with row-level security, so a mistake in the app can't expose another user's or another business's records.
The browser isn't trusted with money or stock
Prices, totals, tax and stock changes are calculated on the server. The interface asks; the server decides.
Least privilege by default
Users get roles with only the permissions they need, and admin actions are restricted to admins. Deactivated users lose access straight away.
Secrets stay out of the code
API keys and service credentials go in environment variables on the server, never in the repository or in a mobile or web bundle.
Security rules are tested
On projects where it matters, automated tests check the access rules themselves: who can read what, and what a user from one business can see of another.
Your data stays your data
We only access client data when the work needs it, use sample or test data during development wherever possible, and hand everything back at the end of a project.
Responsible disclosure
Found a vulnerability?
If you've found a security problem in this website or in software we maintain, please email us with the steps to reproduce it and what you think the impact is. We'll reply, keep you updated while we fix it, and won't take legal action against anyone reporting in good faith. Please give us a reasonable chance to fix it before telling anyone else.
Email info@techintuitors.com