Security
How we protect members and how you can help
What we do to keep your data private and the platform in the right hands. The Privacy Policy is the official statement.
Each table below lists one layer of protection: what it is, what it does, and when it runs. No single layer is trusted on its own.
1The database (backend)
Your data lives in a Postgres database hosted by Supabase. The database decides who may read or change each record, whatever a page asks for.
| Measure | What it does | When |
|---|---|---|
| Row-level security | Every table that holds member data checks who is asking before it returns or changes a row. A page cannot switch this off. | Every request |
| Membership check | Taking part (posting, messaging, joining, scheduling) requires an active membership, checked by the database itself. | Every request |
| Group rules | Only a network’s managers, a business’s owners and admins, or a project’s editors can change that group’s records. When someone leaves a group, their access to it ends at once. | Every change |
| Archived groups locked | An archived network or business, and its projects, events and listings, can’t be opened by anyone until the person holding the archive revives it. | Always |
| Protected functions | Database functions that run with extra rights check the caller first and run with a fixed search path, so they can’t be redirected. | Every call |
| Staff access by area | Each Coordinator is given only the areas they work in, such as support, reports, membership or the fund. Moderation actions and billing changes are logged with who made them. | Every staff action |
| Separate test copy | Every database change is applied and tested on a separate staging copy, with its own accounts, before it reaches live. | Every change |
| Schema comparison | A scheduled check compares the structure of live and staging and flags any difference. | Daily |
2Sign-in and accounts
| Measure | What it does | When |
|---|---|---|
| Bot check | Cloudflare Turnstile checks that a person, not a bot, is signing up or signing in. | Every sign-up and sign-in |
| Passwords | Sign-up requires at least 8 characters. Supabase Auth stores passwords only as one-way hashes; nobody can read them. | Every sign-up |
| Two-step sign-in | Required for every account. Signing in on a new device needs a six-digit code from an authenticator app as well as the password, and an account without one is asked to set it up before the app opens. Members can add a backup authenticator, so a lost phone does not lock them out, from Profile → Sign-in security. For staff accounts the database enforces it as well: staff powers do not work in a session that has not answered the code. | Every sign-in |
| Unstarted sign-ups removed | An account that never starts a free trial is deleted once it is 24 hours old. | Hourly |
| Blocking and reports | Block anyone from their card or from Blocked in the top bar; they can no longer message you. Report posts or accounts; Coordinators review reports and can warn, suspend or ban. | Any time |
| Account deletion | After a verified request, personal data is deleted or anonymized within 30 days and backup copies are purged within 90. | On request |
3Your data, stored and moving
| Measure | What it does | When |
|---|---|---|
| Encryption | Data travels over TLS (HTTPS) and is encrypted on disk (AES-256) at Supabase, Cloudflare and Resend. | Always |
| Payments | Card details are entered on Stripe’s pages, for memberships and the Market alike. They never reach our servers. | Every payment |
| Private files | Chat attachments, digital goods and original showcase photos are kept in private storage. They open only through links that expire within minutes. | Every download |
| Chat files expire | Files shared in chat are deleted 24 hours after they are sent. | Hourly |
| Location shielding | Unless you turn it off, the map shows your general area, not your exact spot. | Always |
| No ads or trackers | We run no ads and no advertising trackers, and we do not sell your data. | Always |
4In your browser (frontend)
| Measure | What it does | When |
|---|---|---|
| Security headers | Every page is sent with a Content-Security-Policy that lets the browser load scripts, frames and data only from the services we use, and refuses to let other sites frame our pages. The browser is also told to use HTTPS only, not to guess file types, and to share only our site name with the sites you visit next. | Every page |
| Text is escaped | Anything a member types is shown as text, never run as code. | Every page |
| Web addresses checked | Showcase links and profile, business and network pictures must be plain https addresses. The database refuses anything that could carry code, and the page escapes the address as well. | Every save |
| Controls follow permissions | A button you may not use is hidden or disabled, and the database refuses the action anyway. | Every page |
| Saves are verified | After a save, the page checks that the database actually changed a record, and tells you if it didn’t. | Every save |
| Offline cache holds no data | The app’s offline cache stores only page files, never your data, sign-in or server replies. | Always |
| Nothing extra published | Tests, documents, reports and server code are left out of every release, and a check confirms the live site does not serve them. | Every release, and hourly |
5Vulnerability scans
One rulebook lists what each kind of user may do: 30 rules, checked for 15 kinds of user — signed out, members of different ranks, a former creator, someone who switched accounts, and more. For each, the rule says whether an action is allowed, visible but disabled, or hidden entirely. The scans test the platform against it.
| Scan | What it checks | When |
|---|---|---|
| Database scan | Signs in as each kind of user on the test copy and asks the database what it allows, including whether a write really changed a record. | Hourly, and nightly |
| Browser scan | Opens the real pages in a browser as each kind of user: is each control hidden, disabled or enabled, and did any protected value reach the page? | Nightly |
| Guard check | Reads the live site’s code and confirms every safeguard the rulebook names is still there. | Hourly, and before each release |
| Unchecked-save count | Counts saves that don’t verify their result. The count may only go down. | Hourly, and before each release |
| Exposure check | Asks the live sites for files that must never be public, and confirms the payout service rejects unsigned requests. | Hourly, and before each release |
| Results board | Every run is recorded on a staff-only board. Any disagreement shows in red, and a scan that stops reporting is flagged too. | Every run |
| Test suite | About 60 automated test files, including real-browser tests, run before each release. | Every release |
6What you can do to add to your security
- Use a password that you don’t use anywhere else.
- Keep Shield my exact location on unless you want an exact pin.
- Share only what you want seen; posts, projects and showcases each have their own visibility.
- Block or report anyone who makes you uncomfortable, and contact the Coordinator through Support.
- If something looks wrong, tell us through Support. Reports like yours are how problems get fixed.
We update this page when our safeguards change. The Privacy Policy and Terms are the official versions.