Security at RootCause Simulator
How we protect your data and the controls we have in place
Security controls currently in place
These are implemented, tested, and live — not planned.
Row-Level Security (RLS)
Every database table has RLS enabled. Users can only read and write their own records. There are no global queries that could leak data across accounts. Policies are enforced at the Postgres layer — application code cannot bypass them.
Encryption in Transit
All traffic between your browser and our infrastructure uses TLS. We enforce HTTPS with HTTP Strict Transport Security (HSTS) and preload registration, so browsers will not fall back to unencrypted connections.
Security Response Headers
Every HTTP response includes: Content-Security-Policy, X-Frame-Options (DENY), X-Content-Type-Options (nosniff), Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy. These block clickjacking, MIME-sniffing, and cross-site injection at the browser layer.
Encryption at Rest
All data at rest is encrypted at the infrastructure level using AES-256, managed by Supabase on AWS. The database, file storage, and backup volumes are all encrypted.
Append-Only Audit Logs
Sensitive administrative operations are recorded in an append-only audit log. Admin privilege is enforced server-side via Supabase app_metadata — users cannot self-elevate by modifying their own profile.
Account Lockout
Repeated failed login attempts trigger automatic account lockout. Failed attempts are tracked server-side with timestamps. Lockout state can only be cleared by an administrator or after a timeout period.
Input Sanitisation
All rich-text content is sanitised with DOMPurify before storage and rendering, using a strict allowlist of safe HTML tags. Link inputs are validated to http/https only — javascript: and data: URLs are rejected at both the editor and server layers.
Authentication Security
Passwords are hashed and managed by Supabase Auth — we never store or transmit plaintext passwords. Auth callback parameters are validated against a strict allowlist. Session tokens are short-lived and rotated.
Consent and Privacy Records
A timestamped consent record is created at account registration, capturing the policy version accepted. Consent records are retained for 3 years for compliance purposes.
Server-Side API Proxy
External API calls (OpenAI for AI narrative analysis) are proxied through our Supabase Edge Function — they are never made directly from your browser. API keys are stored as server-side secrets and are never exposed to the client.
Infrastructure and data residency
Where your data lives and who operates it.
| Layer | Provider | Location | Certifications |
|---|---|---|---|
| Database & Auth | Supabase (on AWS) | us-east-1 (N. Virginia) | SOC 2 Type II, ISO 27001 |
| Edge Functions | Supabase Edge Runtime (Deno) | us-east-1 | SOC 2 Type II |
| AI Processing | OpenAI API | United States | SOC 2 Type II |
Enterprise customers with specific data residency requirements should contact us to discuss options. AI analysis is opt-in per user — users who do not enable the feature transmit no data to OpenAI.
Planned before general availability
Honest about what is next, not what is done.
Independent penetration test
Third-party assessment by a credentialed security firm. Results summary available to enterprise customers upon request.
Vulnerability disclosure policy
A formal responsible disclosure process and contact channel for security researchers.
Formal incident response runbook
A documented, tested incident response plan covering detection, containment, notification, and post-incident review.
Field-level encryption for sensitive narratives
Application-layer encryption for scenario narrative content, in addition to the existing disk encryption.
Data practices
What we collect, what we don't, and how long we keep it.
We never sell your data
Training records, scenario narratives, and account information are never sold to or shared with third parties for commercial purposes.
No advertising tracking
We do not use advertising pixels, third-party analytics cookies, or behavioural profiling. Usage analytics are internal only.
Minimal data collection
We collect only what is necessary to run the training platform. We do not collect health data, biometric data, or financial information.
Retention at a glance
| Account and training data | Active account lifetime; deleted within 30 days of account closure |
| Consent and security logs | 3 years |
| AI-analysed narrative text | Not retained after API response; governed by OpenAI's retention policy |
| Certification records | Active account lifetime, or extended by written agreement |
Report a security issue
We take vulnerability reports seriously.
If you discover a potential security vulnerability in the platform, please report it responsibly rather than exploiting it or disclosing it publicly before we have had the opportunity to address it. We will acknowledge receipt within 2 business days and aim to resolve confirmed issues promptly.
RootCauseSim@gmail.comA formal vulnerability disclosure policy is planned prior to general availability.
Related documents