Security

Last updated: 19 July 2026

Encryption

• In transit: all connections use HTTPS with HSTS.
• At rest: database encryption is managed by our provider, Supabase.
• Passwords: stored as one-way hashes by Supabase Auth — we never see your plain password.

Access control

• Row-level security (RLS) on every database table — users can only access their own data.
• Admin access is role-scoped and audited.
• Service keys are never exposed to the browser.

Security headers

• Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and HSTS are set on all responses.

Vulnerability reporting

If you find a security issue, please report it responsibly to seun@lotipic.com with "Security" in the subject. Please don't publicly disclose it until we've had a chance to fix it.

Breach notification

In the event of a personal data breach, we will notify the ICO within 72 hours where required by UK GDPR Article 33, and notify affected users without undue delay where there is a high risk to their rights and freedoms (Article 34).