Security

• In transit — every request to our domain is served over HTTPS using TLS 1.3. HTTP requests are redirected to HTTPS by the platform edge.
• At rest — Supabase Postgres encrypts the database volume using AES-256. Vercel Blob storage encrypts uploaded photos and AI outputs using AES-256 server-side.
• Secrets — API keys, database credentials, and webhook signing secrets are stored as encrypted environment variables in Vercel and never committed to source control.

• Row-level security — every table in our database is gated by Postgres RLS policies. You can only ever read or write rows tied to your own authenticated user id.
• Service-role access — administrative actions use a separate service-role key with a hard-coded allowlist of operator emails (`ADMIN_EMAILS`). The allowlist is reviewed quarterly.
• Multi-factor authentication — TOTP MFA is available on every account via Supabase Auth. We recommend enabling it from your account settings, especially for owners of paid plans.
• Session security — Supabase sessions use HTTP- only, SameSite=Lax cookies. Sessions expire after 30 days of inactivity.

We follow GDPR Article 33 / Lithuanian VDAI timelines. If we become aware of a personal-data breach, we will:

• Notify the supervisory authority (VDAI) within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to your rights and freedoms.
• Notify affected users without undue delay when the breach is likely to result in a high risk to your rights — via the email on file.
• Maintain an internal breach register with detection time, affected categories, mitigation actions, and post-mortem.

If you believe you have found a vulnerability, please email security@platerefresh.com. Include reproduction steps and a target URL where applicable. We acknowledge reports within two business days.

We currently do not run a public bug-bounty programme, but we may offer a discretionary reward for high-impact findings. Please do not test on production accounts other than your own; we will work with you to set up a sandbox if needed.

All third-party services that touch personal data are listed on our sub-processors page. We use only providers with a current GDPR-compliant data-processing agreement on file.

Every photo we render is marked as AI-generated in its EXIF metadata, in line with EU AI Act Article 50. Read more on our AI usage page.