Security

1. How your data is protected

Encryption at rest

Application data is stored in Postgres (Supabase). The disk is encrypted by the cloud provider. OAuth refresh tokens used by the Google Workspace connector are additionally encrypted at the application layer before being written to the database, so a database-only compromise still doesn't hand over a working token.

Encryption in transit

Every connection — browser to app, app to database, app to Google's APIs — uses TLS 1.2+. We do not accept plain HTTP for anything; the marketing site, app, and APIs all redirect to HTTPS.

Tenant isolation

Every tenant-scoped table in our database has Postgres row-level security (RLS) policies that key on tenant_id. The only paths that bypass RLS are server-side service-role calls, and those go through helpers that always re-check tenant membership for the calling user before responding.

Authentication

Authentication is handled by Supabase Auth. We support email + password and Google OAuth sign-in. Sessions use httpOnly, SameSite=lax, secure cookies. Multi-factor authentication is available on the account; we recommend it for owners.

Authorisation

Roles are owner, validator, and member. Capability checks live in a single permissions table in our codebase, and every API route enforces them via a shared requireWorkspaceActor helper. Validators can approve and reject items; members can submit; only owners can change billing or delete a workspace.

2. The discovery connector — what we read

The Google Workspace connector requests two read-only scopes:

• admin.directory.user.readonly — list active users in your domain.
• admin.directory.user.security — list each user's third-party OAuth grants (the OAuth client ID, app display name, and granted scopes).

These are the minimum scopes required to enumerate shadow AI in a Workspace org. We do not request access to email, Drive, Calendar, Contacts, or any user-generated content. Google's consent screen will show these scopes by name when you connect.

You can revoke the connection at any time from Settings → Connectors. Revocation removes our refresh token immediately and also calls Google's revoke endpoint to invalidate the grant on their side.

3. Backups and durability

Postgres is backed up daily by Supabase, with point-in-time recovery available within the retention window. Backups are encrypted and stored in the same region as the primary database.

4. Logging and monitoring

• Application errors are reported to Sentry, with request bodies and identifying user details scrubbed.
• Server logs (HTTP method, path, status, latency) are retained for up to 30 days for security and debugging.
• Audit-log entries inside your workspace (item edits, status transitions, deletions) are stored and exposed to owners; their retention follows your plan.

5. Vendor security

We rely on a small number of well-vetted infrastructure providers: Supabase, Vercel, Stripe, Resend, Sentry, Google. Each is named in our Privacy Policy with the type of data they process.

6. Compliance status

We are committed to following industry best practices. We do not currently claim SOC 2 Type II, ISO 27001, or HIPAA. If a control framework matters for your purchase, please contact us.

Warnd's automated risk scan is rule-based and does not call an LLM or read customer data. The full scoring methodology — five dimensions, weights, vendor lists, and limits — is published at /risk-methodology for auditors and compliance reviewers.

7. Coordinated vulnerability disclosure

If you believe you've found a security issue, please email security@warnd.app with a description and reproduction steps. We'll acknowledge within 2 business days.

We ask that you:

• Don't access data that isn't yours; use a test workspace.
• Don't run automated scanners against production.
• Don't publicly disclose until we've had a chance to fix.

We won't pursue legal action against good-faith researchers who follow these rules. We don't currently run a paid bug bounty, but we'll publicly thank you (with permission) and send swag.

8. Subprocessor changes

Material changes to our list of subprocessors are announced in-app at least 14 days before they take effect.

9. Contact

Security or vulnerability reports: security@warnd.app. General questions: hello@warnd.app.