Security at Spendbase

All data is encrypted at rest using AES-256 and in transit via TLS 1.2+. Passwords are never stored — Supabase Auth handles credential hashing using bcrypt.

Every database table has Row Level Security enabled in Postgres. Your workspace data is inaccessible to other users at the database level — not just in application code.

Authentication is provided by Supabase Auth. Sessions use secure, HTTP-only cookies with a 1-year expiry. Google SSO is available as an alternative to email/password.

Spendbase runs on Vercel (serverless, edge) backed by Supabase on AWS. Infrastructure is managed by providers with SOC 2 Type II certification.

No card data ever touches our servers. All payments are processed by Razorpay, which is PCI DSS Level 1 compliant — the highest level of certification available.

Workspace data is role-scoped (owner, admin, member). Privileged operations — workspace creation, team management, billing — use a service-role client that bypasses RLS only for bootstrap flows, with explicit permission checks in every action.