Trust & Safety
Security at RouteWrk
Security isn't a checkbox; it's how we build. Here's an honest look at the controls, practices, and infrastructure that protect your data.
Encrypted in transit & at rest
TLS 1.3 in transit, AES-256 at rest, managed by our infrastructure providers.
SOC 2 infrastructure
Hosted on Supabase and Vercel, both SOC 2 Type II certified.
Workspace isolation
Row Level Security isolates every workspace at the database level.
72-hour breach notice
We notify affected users within 72 hours of any confirmed incident.
A note on where we are
RouteWrk is an early-stage product built by a small team. We've built strong foundations from day one (encryption, workspace isolation, and SOC 2-certified infrastructure), but we are not yet independently SOC 2 certified ourselves (our infrastructure providers are), and we'd rather say so plainly than imply otherwise. This page describes what's actually true today. As we grow, we'll formalize more of these controls and update this page accordingly.
Contents
1. Infrastructure & hosting
RouteWrk runs on managed cloud infrastructure: Supabase for our database, authentication, and file storage, and Vercel for application hosting. Both hold SOC 2 Type II certification. Supabase runs on AWS, and customer data is stored and processed in the United States.
Physical security
Our infrastructure runs in AWS data centers with 24/7 physical security, biometric access controls, and redundancy across availability zones. We have no physical access to the underlying hardware.
Workspace isolation
Every workspace's data is isolated at the database level using Supabase Row Level Security (RLS). Access is scoped per user and per workspace, so one workspace can never read another's data.
Data residency
Customer data is stored and processed in the US. If you have specific regional requirements, contact us to discuss options.
2. Encryption
Encryption at rest and key management are handled by Supabase's managed platform. We never store plaintext passwords: Supabase Auth keeps only a salted hash. Connecting a mailbox uses Google OAuth, so your email password never reaches us at all.
3. Access controls
For your team
RouteWrk provides role-based access control at the workspace level. Workspace owners assign roles (Viewer, Editor, or Manager) controlling what each user can see and do.
Session management: sessions use short-lived tokens with automatic refresh, managed by Supabase Auth; signing out revokes your session on that device
Per-workspace access grants: teammates only see the workspaces they've been explicitly granted access to
Administrative access
RouteWrk is operated by a small team. We keep internal access tight:
Access to production systems is limited to authorized operators and protected by two-factor authentication on our infrastructure providers (GitHub, Supabase, Vercel)
We access customer data only when necessary to operate the service or provide support you've requested
4. Network security
Firewall & WAF
All traffic is fronted by Cloudflare, which provides DDoS mitigation, a web application firewall, and bot filtering at the edge.
Rate limiting
Sensitive endpoints are rate-limited to slow down automated abuse and credential-stuffing attempts.
HTTPS-only
HTTP is permanently redirected to HTTPS. HSTS headers are set with a one-year max-age, including subdomains.
Row Level Security
Access to your data goes through authenticated APIs that enforce Row Level Security on every request, scoped to your user and workspace.
5. Secure development
Security is part of how we ship, not an afterthought:
Secrets scanning: a secrets-and-risky-pattern scan runs as a pre-commit gate, so credentials never reach the repository
Automated tests & checks: an automated test suite and static checks run before changes ship to production
Dependency hygiene: we keep dependencies up to date and review advisories for known vulnerabilities
Secrets management: application secrets and API keys are stored as environment variables in our hosting provider, never committed to source code
6. Data ownership & deletion
The data you put into RouteWrk is yours. We process it only to run the service on your behalf. We don't sell it, and we don't use your customer content to train AI models. You can request an export or deletion of your data at any time through our contact form. When you delete your account, we purge your personal data within 30 days, except where retention is required by law (for example, billing records).
On availability: as an early-stage product, we don't yet offer a contractual uptime SLA, and we'd rather be upfront about that than over-promise. Formal availability commitments will come as the product matures.
7. Incident response
If something goes wrong, here's how we respond:
Contain
If we identify a compromise, we isolate affected systems and rotate any exposed credentials immediately.
Notify
If we confirm a breach affecting your data, we notify you by email without undue delay and within 72 hours, describing what happened and the steps we've taken.
Learn
After a significant incident we complete a written review to identify the root cause and prevent recurrence.
If you believe your account has been compromised, contact us right away through our contact form and we'll prioritize your case.
8. Subprocessors
We work with a limited set of trusted subprocessors, each engaged only for the purpose below. Some receive data only in specific cases: Google and Microsoft when you connect that email integration, and Stripe when you purchase a paid plan.
We'll notify customers before adding a new subprocessor that processes personal data. To receive these notices, keep your account email current.
9. Responsible disclosure
We appreciate the security research community and welcome reports of potential vulnerabilities. If you discover a security issue in RouteWrk, please report it responsibly rather than disclosing it publicly before we've had a chance to address it.
How to report
Send a report through our contact form with a detailed description of the vulnerability, steps to reproduce, and your assessment of impact.
Our commitment
We'll acknowledge your report within 2 business days, keep you informed of our progress, and let you know when the issue is resolved. We ask for a 90-day coordinated disclosure window before public release.
Safe harbor
We will not pursue legal action against researchers who discover and report vulnerabilities in good faith, act within the scope of this policy, and do not access, modify, or delete customer data.
Security questions or reports
For any security vulnerability, incident, or data question, reach us through our contact form. We monitor security reports closely and respond quickly.