How we protect
your business data.
This page describes the security practices and infrastructure approach that RomyLabs applies across its products. We state only what is actually implemented. We do not claim certifications, compliance frameworks, or guarantees we have not verified.
Authentication
All RomyLabs products use industry-standard JWT-based authentication managed through Supabase Auth. Sessions are short-lived and cryptographically signed. Passwords are never stored — they are hashed using bcrypt before storage. Multi-factor authentication is available where supported by the product.
Authorization and data isolation
Each product enforces tenant-level data isolation through Row Level Security (RLS) policies applied at the database layer. Every query is scoped to the authenticated tenant — not enforced only at the application layer where a bug could expose another organization's data.
Data in transit
All data transmitted between users and RomyLabs systems is encrypted in transit using TLS 1.2 or higher. HTTPS is enforced across all product domains. Certificates are provisioned and auto-renewed through Cloudflare.
Data at rest
Database storage is hosted on Supabase (PostgreSQL on AWS infrastructure). Data at rest is encrypted using AES-256 encryption as provided by the underlying cloud infrastructure. Supabase's own security documentation covers the infrastructure-level encryption in detail.
Infrastructure
Application frontends are deployed on Cloudflare Pages, which provides global edge delivery, DDoS mitigation, and automatic TLS. Backend functions run as Supabase Edge Functions, isolated per function, with least-privilege service roles. No shared credentials exist across products or tenants.
Access control
Each product implements role-based access control tailored to the workflows of its industry. Administrative access to platform infrastructure is restricted to authorized personnel only. Production database access is not available to general staff accounts.
Vulnerability approach
We review dependencies for known vulnerabilities as part of our development process. Sensitive functionality is reviewed for SQL injection, authentication bypass, and privilege escalation risks before deployment. Security findings are prioritized ahead of feature work.
Incident response
In the event of a confirmed security incident, affected customers are notified directly and promptly. We do not delay disclosure in favor of reputation management. If you discover a potential security issue, contact us at the address below.
Technology we rely on.
The following are the primary technology providers RomyLabs uses across its products. For detailed infrastructure security information, each provider's own documentation applies.
Cloudflare
Frontend delivery, DDoS protection, TLS, and CDN. All product frontends deploy through Cloudflare Pages.
Supabase / PostgreSQL
Database, authentication, real-time subscriptions, and serverless edge functions. Row Level Security enforced at the database layer across all products.
GitHub
Source code management and CI/CD pipelines. Code is reviewed before deployment. No direct push to production without a build and deployment pipeline.
Stripe
Payment processing where applicable. Card data is never stored or transmitted through RomyLabs systems — all payment data is handled directly by Stripe's PCI-compliant infrastructure.
Security contact.
If you believe you have found a security vulnerability in any RomyLabs product, please contact us directly. Do not publish or share the issue publicly until we have had the opportunity to investigate and address it.
Contact RomyLabs →