Loading...
Security and privacy controls are implemented across managed infrastructure, authenticated services, and tenant-scoped data access.
Multiple layers of protection ensure your data remains secure and private at all times
Traffic between your browser and the application is encrypted in transit using standard TLS.
Workloads run on managed cloud infrastructure with isolated services, authenticated internal APIs, and continuous health monitoring.
Production data is stored in Supabase Postgres with row-level security policies and scoped service access controls.
Authentication and session handling run through Supabase Auth with tenant-scoped access patterns.
Privacy-first principles: collect only what is needed for the product, and provide controls to manage your data.
Operational monitoring, scheduled trust checks, and fail-secure API guardrails help detect and contain issues quickly.
Multi-layered security architecture protecting every aspect of your data
TLS termination and hosting-provider protections
Authentication, authorization, and server-side secrets
Database policies and least-privilege access
Common questions about our security practices
MyRoofGenius uses TLS in transit, security headers (HSTS, CSP, X-Frame-Options), signed Stripe webhooks verified server-side, Supabase Auth with scoped sessions, and Row-Level Security (RLS) policies on 99.9% of database tables for tenant isolation.
Production account and subscription data is stored in Supabase Postgres. Payment data is processed by Stripe. Object/file storage follows the configured provider for your deployment.
Access is controlled by your organization’s users and the permissions/policies configured in your deployment. Support access, if any, should be explicitly authorized and scoped to the minimum needed.
Defense-in-depth: authentication, authorization, provider-level protections, and monitoring. Specific controls and guarantees depend on your hosting and database providers.
You can export your data before cancellation. Standard retention is 30 days for report access after cancel, then data enters deletion workflow according to legal and billing retention requirements.
Use responsible disclosure by emailing security@myroofgenius.com with reproduction details and impact. Initial triage target is within 1 business day.
Contact support to discuss requirements and request security documentation for your deployment.