Access controls
Account sessions use Supabase Auth. Workspace data is isolated with row-level security, and privileged ingestion and billing tables are inaccessible to browser clients.
API keys and payments
API keys are stored as one-way hashes and may be revoked. Stripe hosts checkout and the customer portal; webhook signatures are verified before entitlements change.
Responsible disclosure
Send suspected vulnerabilities to security@recallmatching.com. Include reproduction steps and avoid accessing data that is not yours.