Elevale protects your data with layered authentication, encryption, access controls, and operational safeguards. This page summarises the technical and organisational measures we apply across the platform.
Authentication
- Multi-factor authentication (email or authenticator app) required after signup
- Privileged platform roles (super admin, agency admin) must use MFA
- Password reset and session management via Supabase Auth
- Session timeout and secure cookie flags on authentication tokens
- Rate limiting on login and password reset endpoints
Encryption
- In transit: TLS 1.2+ for all connections between clients, APIs, and subprocessors
- At rest: Supabase encrypted storage; database volumes encrypted by the hosting provider
- OAuth tokens: Encrypted server-side before storage
- Secrets: API keys stored as hashes; plaintext secrets are not logged
Access control
- Row Level Security (RLS) on all tenant-scoped database tables
- Role-based access at system, organisation, and workspace levels
- Custom workspace roles with granular permissions
- Principle of least privilege for internal admin access
- Separate production and non-production environments
Application security
- Input validation and output encoding to reduce injection risk
- CSRF protection on state-changing requests
- Security headers on web responses (CSP, HSTS where applicable)
- Dependency monitoring and regular security patching
- Code review for security-sensitive changes
Key rotation
API keys and OAuth encryption keys are rotated on a documented schedule. The operations team follows an internal key rotation checklist. Compromised keys are revoked immediately.
Monitoring and incident response
We monitor for anomalous access patterns, error spikes, and infrastructure alerts. Security incidents are handled per Incident response and data breaches. Report concerns to contact form.
Disaster recovery
Supabase point-in-time recovery and Fly.io redeployment support business continuity. Target recovery time objective (RTO): 4 hours. Target recovery point objective (RPO): 1 hour for the primary database.
Personnel and vendors
Staff with production access undergo background checks where appropriate and receive security training. Subprocessors are assessed against our security requirements before engagement.