Security Practices

Last updated: February 2026

1. Data Encryption

All data transmitted between your browser and our servers is encrypted using TLS 1.2+ (HTTPS). Database connections use TLS encryption. Uploaded PDF files are encrypted at rest using AES-256 in our cloud storage. Database backups are also encrypted at rest.

  • TLS 1.2+ for all data in transit
  • AES-256 encryption for all stored files
  • Encrypted database backups with point-in-time recovery
  • API keys and secrets are encrypted and never exposed to clients

2. Access Control

We implement strict multi-tenant data isolation using PostgreSQL Row-Level Security (RLS). Every database table is protected by RLS policies that ensure users can only access data belonging to their organization.

  • Row-Level Security (RLS) on all database tables with 28+ policies
  • Role-based access control (Admin, Operator, Viewer)
  • Session-based authentication with secure HTTP-only cookies
  • API rate limiting to prevent abuse and brute-force attacks
  • Input validation using Zod schemas on all API endpoints

3. Infrastructure

Our application is deployed on enterprise-grade cloud infrastructure with automatic scaling, redundancy, and geographic distribution.

  • Hosted on Vercel (frontend) and Supabase (database, auth, storage)
  • PostgreSQL 17 with automated backups and point-in-time recovery
  • CDN-delivered static assets for performance and DDoS mitigation
  • Environment-based configuration with no secrets in source code
  • Health monitoring endpoint for automated uptime checks

4. Compliance

We take data privacy seriously and design our systems with compliance in mind.

  • SOC 2 Type II compliant infrastructure providers (Supabase, Vercel)
  • GDPR-aware data handling practices with data residency options
  • Data Processing Agreement (DPA) available for enterprise customers
  • Regular security reviews and dependency audits
  • Audit logging for all data access and modifications

5. Incident Response

In the event of a security incident, we follow a structured response process: identification, containment, eradication, and recovery. Affected customers will be notified within 72 hours of a confirmed breach, in compliance with applicable regulations. We maintain incident response procedures and conduct periodic tabletop exercises to ensure readiness.

6. Responsible Disclosure

We welcome security researchers to report vulnerabilities responsibly. If you discover a security issue, please contact us at security@poprocessing.com. We commit to acknowledging reports within 48 hours and providing status updates as we investigate. We will not take legal action against researchers who follow responsible disclosure practices.