Last updated: June 2025 · [email protected]
Supplira is built with practical security controls, transparent architecture, and EU-focused data handling. This page describes implemented controls — it is not a certification statement and does not guarantee regulatory compliance.
PostgreSQL Row-Level Security (RLS). Tenant isolation is enforced at the database layer using account-scoped row-level security policies. All runtime application queries use a restricted database role that is subject to RLS. This means that even a correctly-formed query from one customer account cannot return data belonging to another. RLS policies are covered by automated integration tests.
Privileged role separation. Runtime application queries use a restricted database role with limited permissions. Certain sensitive tables (authentication attempts, MFA recovery codes, signup data) are accessible only to a privileged role used for background operations — not accessible from the runtime application path.
Server-side authorisation. Access checks are enforced in application logic before data is returned or modified, in addition to database-level controls.
Audit logging. Security-relevant events and account activity are recorded in an application audit log. Account administrators can review account-scoped audit history.
Password hashing. Passwords are stored using bcrypt with an appropriate cost factor. Plaintext passwords are never stored or logged.
Multi-factor authentication. TOTP-based MFA is supported for all user accounts. MFA secrets are encrypted at the application layer using a dedicated encryption key, separate from the session secret.
Session security. Sessions use HTTP-only, secure-flagged cookies. Session tokens are not stored in localStorage or accessible from JavaScript. Sessions have a configured expiration.
Rate limiting. Login and MFA attempts are rate-limited by IP and email domain to reduce brute-force risk. Signup is protected by Cloudflare Turnstile to prevent automated abuse.
Platform administration. Platform administrator capabilities are separated from normal customer account access. Platform admin users cannot access customer account data through normal customer-facing flows.
Supplira's primary application database is hosted in Sweden (AWS eu-north-1), within the European Economic Area. The application itself runs on Vercel's edge infrastructure, with European region routing where available.
Some supporting services (email delivery, security tooling, observability) may use approved subprocessors. A current list is maintained on the Subprocessors page.
Supplira is designed for teams handling supplier-related personal and operational data in a GDPR-aware workflow.
Use of Supplira does not, by itself, satisfy your legal or regulatory obligations. You remain responsible for your compliance programme and how you use the Service.
Supplira does not currently hold a SOC 2 or ISO 27001 certification. SOC 2 Type II is on our roadmap for 2026. Customers with specific certification requirements can contact us to discuss available evidence packages, including the security controls described on this page.
If you believe you have found a security vulnerability in Supplira, please report it to [email protected]. Include enough detail to allow us to reproduce and investigate the issue.
We ask that you:
We will acknowledge receipt within two business days and aim to provide a substantive response within seven business days. We do not currently operate a paid bug bounty programme but we do acknowledge responsible disclosures publicly if the researcher wishes.
We continue to improve security controls over time. This page is updated when material controls change. For questions, contact [email protected].