Security at Depentra

Our approach

Security is enforced where it cannot be bypassed: in the database. Every table enforces row-level security, so a query can only ever return data belonging to your organisation, and plan limits and write permissions are checked by the database itself rather than trusted to the browser. A strict Content Security Policy pins the application's network egress to the services it actually uses.

Encryption standards

• All data in transit is encrypted with TLS 1.2 or above; HSTS is enforced.
• All data at rest is encrypted with AES-256, including database and backups.
• Authentication is handled by Supabase Auth. Passwords are stored as bcrypt hashes and are never held or logged in plaintext by Depentra.

Infrastructure

Depentra runs on Cloudflare's global edge network with Supabase-managed PostgreSQL and authentication. Automated backups are managed by Supabase. Payments are processed by Stripe; card details never touch Depentra's servers.

Access controls

• Role-based access with Owner, Editor, Contributor, and Viewer roles per project.
• Row-level security enforced at the database layer for every query.
• Sessions are managed by Supabase Auth with signed, expiring tokens.
• Invitation codes are single-use, rate-limited, and expire; billing endpoints are rate-limited per IP.

Testing

An automated test suite covers the scheduling engine, seat accounting, and rate limiting, and runs with every change. No independent penetration test has been performed yet; when one is, its findings and date will be published on this page. We prefer telling you that plainly to implying otherwise.

Data rights

• Export and erasure requests are honoured: contact sales@depentra.com and we will export or delete your organisation's data.

Vulnerability disclosure

We welcome good-faith security research. Report vulnerabilities to sales@depentra.com with steps to reproduce. We aim to acknowledge within 2 business days, keep you informed through remediation, and do not pursue legal action against researchers acting in good faith within the Acceptable Use Policy. Please do not access other customers' data or degrade the service.