Security
The baseline we work to.
Here is how we handle data, encryption, access, and vulnerability disclosure. Technical details are available when you want them, in plain language when you don't.
Encryption
Encrypted in transit and at rest. OAuth tokens twice.
Data in transit uses TLS 1.2 or higher. Data at rest is encrypted at the database layer by our managed PostgreSQL provider (Supabase).
Authentication
Sessions you can revoke. Passwords we never see.
Authentication runs on better-auth with signed, server-managed session tokens. Passwords are hashed before they reach the database. OAuth 2.0 via Google or GitHub is available if you prefer not to manage a password at all.
Sessions are scoped and revocable. Email us if you suspect your account is compromised and we revoke every active session.
Access
Row-level security on every table.
Supabase Row-Level Security is enabled on every table. Every read and write is scoped to the authenticated user or organization. A logged-in user cannot query another user's data, even with a valid session token.
Private personas are visible only to their owner and authorized organization members. Public personas are readable without auth but writable only by their owner.
Infrastructure
Built on SOC 2 providers.
Personaxis runs on Vercel (edge and serverless) and Supabase (managed PostgreSQL with automatic backups), both SOC 2 compliant. We rely on their posture at this stage, and we say so plainly here rather than implying a certification we do not hold.
Your data
Private specs stay yours. We don't train on them.
PERSONA.md specs you publish publicly are visible to anyone. Specs you keep private are encrypted at rest and accessible only to you and your authorized team.
We do not use private persona content to train AI models or share it with third parties. Your spec is your intellectual property. You can delete your data at any time from account settings.
Disclosure
Found a vulnerability? Tell us.
Send a clear description, steps to reproduce, and potential impact. We respond within 72 hours.
We credit responsible disclosures publicly if you want it. We don't pursue legal action against researchers who report in good faith, within scope, and without exploiting the issue.
Out of scope
These are explicitly out of scope. We'll acknowledge reports but won't action them.
- 01Social engineering attacks against Personaxis employees
- 02Denial of service testing against production
- 03Attacks on third-party infrastructure we don't control
Have a security question we didn't cover?
We answer plainly. No legal-team boilerplate.