Security
Last updated July 9, 2026
The honest version of our security posture — what we actually do, not a wall of compliance logos. We’re a small team, so the strategy is simple: hold as little sensitive data as possible and lean on infrastructure that specializes in the rest.
Sign-in without passwords
Authentication is email magic links via Supabase. There is no password to set, so there is no password for us to store, hash, leak, or have phished. Each sign-in link is single-use and short-lived, and sessions ride in a secure cookie.
Your rows are yours
Job data lives in Supabase (Postgres) with row-level security enforced in the database itself: every query runs as your account and can only reach rows your account owns. Isolation between customers isn’t an application-code promise — it’s a database rule.
Card data never touches us
All payments run through Stripe. Card numbers go from your browser straight to Stripe’s PCI-compliant systems; our servers see only your subscription status. We couldn’t leak your card number, because we never have it.
Encryption and secrets
- TLS on every connection — browser to us, us to Supabase, Stripe, Resend, and Anthropic.
- API keys and database credentials live in the hosting platform’s encrypted environment vaults — never in the codebase, never in the browser.
- Data is encrypted at rest by our infrastructure providers (Supabase and Vercel).
Found a vulnerability?
Tell us. Email hello@permitmysign.com with “Security report” in the subject and enough detail to reproduce it. A human reads it fast, we’ll keep you posted on the fix, and we will never take legal action against a good-faith report. We don’t run a paid bounty program yet — we’re honest about that too — but we credit reporters who want credit.