Security

Sign-in is handled through our managed authentication provider. Sessions are bound to your account, and every request to backend data is authorized server-side. Workspace membership controls who can read or change data, and roles (owner, admin, member, viewer) gate sensitive actions such as inviting members or transferring ownership.

Every workspace's data lives in its own row-level-security-scoped rows in a shared Postgres database (Supabase). One workspace's rows are not queryable from another's session, enforced at the database layer, not just the application layer. Billing identifiers and invitation tokens are restricted to server-side roles and are never exposed to other members.

Connection credentials and API keys you bring into Supaprod are encrypted before being stored. Decryption happens only inside server-side code paths. Data in transit uses TLS provided by the hosting platform.

Every connected source (GitHub, Slack, Linear, and similar) uses that provider's OAuth flow with the minimum scope the feature needs, shown to you before you grant it. Tokens are encrypted at rest. Disconnect any source anytime from Settings; access ends immediately.

Agents can draft, propose, and build. By default nothing merges, ships, or takes an irreversible outward action without a human approval through the real approval flow, and no workspace setting can change that. The only thing that can is a platform secret we hold, and enabling it does not remove the gate: an agent may merge on its own only after it has earned that on its own record, and only when the change has proven four things first. It is merged, CI was green at that exact commit, a live preview exists at that same commit, and a forecast was recorded to grade the result against.

Rolling back is the one thing gated less, on purpose. An agent that has earned it can roll a change back to a known-good commit without asking, because the merge can already run on its own and gating the undo harder than the do would leave the loop unable to fix what it broke. Every rollback is written down as it happens, with the change it undid, the reverting change it created, and the reason given for it.

Your product's decisions, specs, and code are not used to train a shared model. See the privacy policy for the full statement.

Supaprod relies on infrastructure and AI providers to deliver the product, and on third-party services that you explicitly connect (for example a code repository or calendar). The full, live list of sub-processors and what each one receives is public at the sub-processor disclosure. Connections you create are scoped to your workspace, and you can disconnect them at any time from Settings.

You can delete data you have created (workspaces, products, documents, signals) from inside the app, and export your data in open formats from Settings. Account deletion or data export requests can also be made by emailing privacy@supaprod.ai.

If you find a security issue, tell us before you tell anyone else. Email security@supaprod.ai. We will acknowledge real reports and keep you posted as we fix them.

We do not currently hold a SOC 2 or ISO 27001 certification. If your evaluation needs one, tell us. It tells us where to invest next, and we would rather hear it than have you assume otherwise.