Security architecture overview
SOPCompass is a web app hosted on Vercel, backed by a Supabase project with Postgres, authentication and file storage. Access rules live in the database as row-level security, not only in the interface.
SOPCompass, an Ironbridge AI Advisory company, is a web application with a small number of well known parts.
The parts
| Part | Provider | What it does |
|---|---|---|
| Web app | Vercel | Serves the app at app.sopcompass.com, over HTTPS only |
| Server functions | Vercel | Run the AI features, email notifications, the public API, billing sync and the capture extension’s endpoint |
| Database | Supabase (Postgres) | Stores workspaces, SOPs, members, assignments and everything else |
| Authentication | Supabase Auth | Sign-in with Google, an email link, or a password |
| File storage | Supabase Storage | Images, screenshots, videos and temporary document uploads |
| Custom auth domain | auth.sopcompass.com | The address the app uses to reach the Supabase project |
The marketing site, sopcompass.com, is a separate static site. It doesn’t hold any workspace data.
Where access is enforced
Access rules are written as row-level security (RLS) policies in Postgres. Every table in the app’s public schema has RLS turned on. Each query only returns rows the signed-in person is allowed to see, whether it comes from the app, an AI feature or a server function running as that person. Hiding a button is never the only protection.
- Your browser talks to the database directly with your own session. RLS decides what it can read and write.
- AI features and notifications run on Vercel but read and write with your own sign-in, so the same rules apply to them.
- Public share links are read through one database function that returns only that SOP, so an anonymous reader never touches the content tables.
- The public API uses API keys that are checked by the database on every call. See API key security.
Secrets
Provider keys (Anthropic, ElevenLabs, Resend, Whop) are held as environment variables on Vercel and used only by server functions. They are never sent to the browser. Secrets that database functions check, such as the one for Ask history, are stored only as SHA-256 hashes.
Browser protections
- Every path except
/embed/*sendsX-Frame-Options: DENYandframe-ancestors 'none', so the app can’t be framed by another site. Only embeds can be placed in other pages. - The installable app’s service worker caches only the app’s own code and icons. It never caches API responses, sign-in tokens or workspace data.
- SOP content is sanitized when it is displayed.
Learn more
Common questions
Who runs SOPCompass?
SOPCompass, an Ironbridge AI Advisory company. The application runs on Vercel and Supabase.
Do your servers hold a key that bypasses access rules?
No. The app's server functions don't use the database's service role key. Features run with your own sign-in, so row-level security applies. The few endpoints without a user session (billing sync, the capture extension and the public API) can only call specific database functions that check their own credential, a hashed secret, capture token or API key.