Security
Encryption
AES-256 at rest via the Supabase platform, TLS 1.3 in transit via Vercel.
Encryption is applied uniformly to all customer data. Every restaurant gets the same protections — there is no weaker tier.
At rest
Database storage is encrypted with AES-256 at the volume level by the Supabase platform. Backups inherit the same encryption. Row-Level Security in Postgres enforces tenant isolation on every read and write.
In transit
All HTTPS traffic uses TLS 1.3. TLS 1.2 is supported as a fallback for older clients but TLS 1.0 and 1.1 are disabled.
Honest scope note
We do not currently operate per-workspace AWS KMS keys, per-workspace application-level encryption, or quarterly CloudTrail key-audit reviews — earlier versions of this page implied that and it was not accurate. Encryption-at-rest is what the underlying Supabase platform provides. If you require a more specific cryptography posture for a compliance audit, please reach out.