Security

Legal
Security Practices
Effective: April 24, 2026
In plain language
Encrypted in transit (TLS 1.2+) and at rest (AES-256). Every database row is partitioned by family with row-level security. Magic-link auth — no passwords to leak. Documents in private buckets, served only via 10-minute signed URLs. Sensitive operations are audit-logged.
1. Authentication
•
Passwordless magic-link auth via Supabase Auth. There is no password to phish, leak, or rotate.
•
Magic links expire after 60 minutes and are single-use.
•
Sessions refresh transparently via JWT. Stale tokens are rejected.
•
Future: optional 2FA via TOTP for users who want belt-and-suspenders protection.
2. Database isolation
Every table that contains user data has Row-Level Security policies that scope access to the authenticated user's family. The policies are enforced by PostgreSQL itself; even a misconfigured query in our application code cannot return another family's rows.
•
Family membership is the gating predicate (see the app.is_family_member() security-definer function).
•
Sensitive RPCs (data export, account deletion) are SECURITY DEFINER with explicit authorization checks inside.
•
Service-role access is reserved for edge functions and never exposed to the client.
3. File storage
•
Two private buckets: school-pdfs for calendar imports and family-vault for personal documents.
•
File paths are namespaced by family ID: <family_id>/<item_id>.<ext>. Storage RLS enforces this — even a leaked path can't be read by another family.
•
Documents are served via short-lived signed URLs (default 10 minutes, never longer than 1 hour).
•
Maximum file size 50 MB; only image and PDF MIME types accepted.
4. Encryption
Data in transit
TLS 1.2+ everywhere. Insecure HTTP refused.
Data at rest
AES-256 encryption on all Supabase storage and Postgres volumes.
Backups
Encrypted in-flight and at rest. 30-day retention.
Secrets
Stored in EAS Secrets and Supabase Vault. Rotated on suspected compromise.
5. AI handling
•
OpenAI requests are sent from server-side edge functions with a dedicated API key. The mobile app never holds the key.
•
Our OpenAI workspace has "Improve the model for everyone" off and zero data retention enabled.
•
Prompts are logged only as Supabase function logs (not in our database) and are subject to Supabase's own 7-day log retention.
6. Audit logging
The compliance_audit_log table records sensitive operations:
•
Vault item opened (with hashed IP, never the raw IP).
•
Data export requested.
•
Account deletion requested or cancelled.
•
Location sharing toggled.
•
Consent updated.
•
Court / tax export generated.
Logs are visible to the user (Settings → Privacy → Activity log) and retained for 13 months.
7. Dependency hygiene
•
Dependencies pinned in package-lock.json and reviewed before upgrade.
•
GitHub Dependabot alerts subscribed; high-severity advisories patched within 7 days.
•
SBOM exported on every release for supply-chain provenance.
8. Incident response
If we discover a personal-data breach affecting users, we will:
•
Notify the relevant supervisory authority within 72 hours, per GDPR Article 33.
•
Notify affected users without undue delay, per Article 34 — by email and an in-app banner.
•
Publish a post-mortem within 14 days describing root cause, remediation, and prevention.
The on-call rotation pages within 15 minutes for production incidents. Email security@famcove.com to report a vulnerability.
9. Responsible disclosure
We welcome security research. Email security@famcove.com with a description and steps to reproduce. We aim to:
•
Acknowledge within 2 business days.
•
Triage within 7 calendar days.
•
Patch critical issues within 14 calendar days.
•
Credit researchers in our security advisories on request.
We do not currently run a paid bounty program. We will not pursue legal action against good-faith researchers who follow this policy.
10. Honest caveats
We believe the controls above are appropriate for the data we handle, but no system is 100% breach-proof. The most likely failure mode is a misconfigured RLS policy or a leaked secret — that's why we audit RLS on every migration and rotate secrets on schedule.
Questions?
Email privacy@famcove.com — we respond within 30 days as required by GDPR. Replace with your real contact before public launch.