Security at Depentra

Our approach

Security is enforced where it cannot be bypassed: in the database. Every table enforces row-level security, so a query can only ever return data belonging to your organization, and plan limits and write permissions are checked by the database itself rather than trusted to the browser. A strict Content Security Policy pins the application's network egress to the services it actually uses.

Encryption standards

• All data in transit is encrypted with TLS 1.2 or above; HSTS is enforced.
• All data at rest is encrypted with AES-256, including database and backups.
• Authentication is handled by Supabase Auth. Passwords are stored as bcrypt hashes and are never held or logged in plaintext by Depentra.

Infrastructure

Depentra runs on Cloudflare's global edge network with Supabase-managed PostgreSQL and authentication. Automated backups are managed by Supabase. Payments are processed by Stripe; card details never touch Depentra's servers.

Access controls

• Role-based access with Owner, Editor, Contributor, and Viewer roles per project.
• Row-level security enforced at the database layer for every query.
• Sessions are managed by Supabase Auth with signed, expiring tokens.
• Invitations expire after 14 days and an owner or admin can cancel one before it is accepted; billing endpoints are rate-limited per IP.

Testing

An automated test suite covers the scheduling engine, seat accounting, rate limiting, and the database's own access rules (run against a real PostgreSQL engine), and runs with every change. No independent penetration test has been performed yet; when one is, its findings and date will be published on this page. We prefer telling you that plainly to implying otherwise.

Data rights

• Export and erasure requests are honoured: contact sales@depentra.com and we will export or delete your organization's data.

Vulnerability disclosure

We welcome good-faith security research. Report vulnerabilities to sales@depentra.com with steps to reproduce. We aim to acknowledge within 2 business days, keep you informed through remediation, and do not pursue legal action against researchers acting in good faith within the Acceptable Use Policy. Please do not access other customers' data or degrade the service.