1. Our Approach to Security
Security is foundational to Promevra. Because our platform connects to your advertising accounts and handles your business data, we design the product with least-privilege access, defense in depth, and secure-by-default patterns throughout.
2. Encryption
- All traffic to the Services is encrypted in transit using TLS.
- Sensitive credentials, including advertising-platform access tokens, are stored encrypted and are never exposed to the browser.
- Data at rest is protected by our infrastructure providers’ encryption.
3. Access Controls and Authentication
- Authentication is handled by Supabase Auth, with support for email/password, magic links, and social login.
- Organization data is isolated using database row-level security, so users can only access records belonging to organizations they are authorized to view.
- Role-based permissions (Owner, Admin, Marketer, Analyst, Client, Viewer) are enforced on the server, not just hidden in the interface.
- Service-role credentials are restricted to server-side use and are never shipped to clients.
4. Application Security
- Inputs and outputs are validated, including strict validation of AI-generated content before it is stored or used.
- Private files are served through short-lived signed URLs, with file type and size validation on upload.
- Secure HTTP headers, protections against insecure direct object references, and safe error handling are applied across the application.
- Secrets are managed through environment configuration and are kept out of source control and client bundles.
- High-impact advertising actions require explicit human approval and are never performed automatically.
5. Infrastructure and Sub-processors
Promevra runs on established cloud infrastructure and works with a small set of vetted sub-processors — including Supabase (database, auth, storage), Render (hosting and background processing), Anthropic (AI processing), Stripe (billing), and Resend (email). Each is bound by contractual security and confidentiality obligations.
6. Monitoring, Logging, and Auditing
We maintain application logging with secrets redacted, and audit logs of significant actions within an organization. Background jobs track status, retries, and failures to support reliability and investigation.
7. Privacy and Compliance
We handle personal data in line with applicable privacy laws, including PIPEDA and Quebec’s Law 25, and we support data-subject rights under laws such as the GDPR and CCPA/CPRA. See our Privacy Policy for details on how we collect, use, and protect personal data.
8. Responsible Disclosure
We welcome reports from security researchers. If you believe you have found a vulnerability, please contact security@promevra.com with details so we can investigate and respond. We ask that you avoid accessing or modifying other users’ data and give us a reasonable opportunity to remediate before public disclosure.