Security overview

Data storage

All customer data — organizations, users, scans, software inventories, and compliance results — is stored in Supabase (PostgreSQL). Data is hosted in the US East region by default. EU customers requiring data residency within the European Economic Area should contact us before uploading regulated personal data — we are evaluating EU region options.

Encryption

• In transit: All traffic is served over HTTPS / TLS 1.2+. Connections to Supabase are encrypted end-to-end.
• At rest: Supabase encrypts all data at rest using AES-256. Passwords are stored as bcrypt hashes — the raw value is never retained.
• Tokens: Session JWTs are set as Secure, HttpOnly, SameSite=None cookies in production. They are never stored in localStorage.

Access controls

• Row-level security (RLS) is enabled on all customer tables. Your organization can only query its own data — no cross-tenant reads are possible through the API.
• Internal staff operations use a separate JWT with a 15-minute session, MFA, and a required audit reason for every action.
• All authentication events — registration, login, password changes, email verification — are written to an immutable audit log.

What we process

StackGaps processes the software names you upload in a CSV. We do not read the content of the software itself, access your systems, or install agents. The inventory you upload is used only to generate your scan results and is stored under your organization's account.

We do not sell your data or share it with third parties for marketing purposes. Our sub-processors are listed in the Privacy Policy.

Data Processing Agreements (DPAs)

If your organization processes EU personal data and requires a DPA with StackGaps, contact [email protected]. We are in the process of finalizing DPAs with our key sub-processors (Supabase and Railway).

Responsible disclosure

If you discover a security vulnerability, please report it to [email protected]. We will acknowledge receipt within 2 business days and aim to resolve confirmed issues within 30 days. We do not currently operate a paid bug bounty program but we appreciate all responsible disclosures.

Please do not publicly disclose a vulnerability until we have had a reasonable opportunity to investigate and remediate it.

Monitoring and incident response

Application errors are captured by Sentry with personally identifiable information (PII) collection disabled. Uptime is monitored with automated alerts to the engineering team.

In the event of a data breach affecting your organization, we will notify you within 72 hours of becoming aware of the incident, consistent with our obligations under applicable data protection law.