Security & trust

How Supplira protects customer data and operates the platform. This page describes current capabilities—not uptime or disaster-recovery SLAs.

Access & authentication

Passwords are stored using industry-standard hashing (bcrypt).
Multi-factor authentication is supported for account administrators (authenticator app TOTP).
Session handling uses secure HTTP-only cookies with a bounded lifetime.
Sign-in and multi-factor verification attempts are rate limited.

Data isolation & hosting

Customer data is isolated at the database layer using PostgreSQL row-level security (per-account context on authenticated requests).
The primary database is hosted in the EU on managed PostgreSQL (Supabase), configured per deployment environment.
Application hosting uses a managed edge platform (Vercel).

Operations & accountability

Operational and security-sensitive events are audit logged for account administrators.
Configuration and access controls are reviewed operationally before production releases.
Database backups are provided by the managed database operator; restore procedures are tested periodically.

We do not publish guaranteed recovery times or multi-region failover on this page.

Legal & subprocessors

Data processing terms, privacy information, subprocessor lists, and DPAs are available on request from your account team or via published legal pages when provided for your deployment.