Security Policy

Where the data lives

On Supabase, Railway, and Cloudflare infrastructure, operated in the United States. Everything travels encrypted (TLS) and is stored encrypted at rest. Large files go to object storage separate from the database.

Separation by account

Each lab sees only its own data, and that rule lives in the database, not on screen: every query goes through row-level access policies. Even if someone tampered with the application, the database would not hand them another account's data.

Access

Authentication is handled by Supabase. Passwords are never stored in the clear and sessions expire. Credentials are personal: the record of who did what depends on each person using their own.

Each person can turn on two-step verification with an authenticator app. Passwords that have already appeared in public breaches are rejected when created. Before changing an account's security options we ask for the password again, so a session left open is not enough to remove the second factor. Sign-in attempts are rate limited per address.

Files and designs

A case's files live in private storage and open through temporary links. Each file's path says which case it belongs to, and the database checks on every open that the requester can see that case. Photos uploaded from a phone use a link that expires after 30 minutes.

HTML designs exported by design software open in an isolated environment: their scripts work to rotate and measure the piece, but cannot reach the application's session or data.

Backups

The database is backed up automatically every day through our infrastructure provider. Even so, nothing replaces the lab exporting its critical information regularly, and the application allows that at any time.

Who on the team has access

Access to production is limited to the minimum needed to operate and support the service. No one on the team looks at your cases out of curiosity: we access them when there is a problem to solve and you asked, or when running the service requires it.

If something goes wrong

If we confirm a breach that compromises data, we notify the administrator of each affected account within the following 72 hours, as written in the privacy policy and in the DPA.

Reporting a vulnerability

If you find a security problem, write to hola@zircca.com. We treat it as a priority and take no action against anyone who reports in good faith.