Security

• The website and the API are served over HTTPS.
• Our database and file storage are hosted with Supabase in the EU (Ireland); the storage bucket that holds uploaded files is private, and downloads require an authenticated session.
• Two-factor authentication secrets are encrypted with AES-256-GCM before they are stored.
• Uploaded files are checked for type and size, and are never served in a way that lets the browser run them.

• Passwords are stored only as salted bcrypt hashes. We cannot read them.
• Sessions live in an HTTP-only cookie that page scripts cannot read, and expire after seven days.
• You can see where you are signed in and sign out of other devices at any time. Changing your password signs out your other sessions.
• Optional two-factor authentication (an authenticator app, with one-time backup codes) can be turned on from your account.
• Sign-in and account-recovery endpoints are rate limited. Email verification and password-reset links are single use and expire.

• Every record belongs to one company, and every request is checked against the signed-in person's company. Automated tests cover attempts to reach another company's data.
• People are Owners, Admins or Members, and sensitive actions (billing, team management, company deletion) are limited to the roles that need them.
• API keys are shown once when created and stored only as hashes. Each key has a limited scope, can be revoked immediately, and is rate limited.

• Changes made in your account are recorded in an audit log. Actions taken by Oleracore staff on a customer account are logged separately.
• Deleting a company is reversible for 30 days before the data is permanently erased.

We have not completed a formal third-party security audit, penetration test or certification such as SOC 2 or ISO 27001, and we do not claim any. We would rather be clear about that than imply otherwise.

If you believe you have found a security problem, please tell us privately at [SECURITY CONTACT EMAIL TO BE ADDED] and give us a reasonable chance to fix it before you share it publicly. We will not take action against good-faith research.