Encryption in transit and at rest

This page states only what our providers document and what the SOPCompass code does. Links go to the provider’s own documentation.

In transit

• The app and API are served by Vercel. Vercel serves every deployment over HTTPS, redirects plain HTTP to HTTPS, supports TLS 1.2 and 1.3 with forward secret ciphers only, and sends an HSTS header on custom domains. Source: Vercel, Encryption and TLS.
• The database, sign-in and file storage are reached over HTTPS at auth.sopcompass.com, which points at our Supabase project. Supabase states that customer data is encrypted in transit with TLS. Source: Supabase security.
• Calls to AI and email providers from our server functions use the providers’ HTTPS APIs.
• The capture extension sends steps and screenshots only to app.sopcompass.com over HTTPS.

At rest

• Database and files: Supabase states that “all customer data is encrypted at rest with AES-256.” Source: Supabase security.
• Backups are managed by Supabase. See Backups.

What SOPCompass hashes

Some values are stored only as one way SHA-256 hashes, so the original can’t be read back from the database:

• API keys. The full key is shown once when created. See API key security.
• Capture extension tokens.
• Internal secrets that database functions check, such as those for billing sync and Ask history.
• Visitor IP addresses for the free generator’s daily limit, salted before hashing and deleted once they are more than two days old, the next time the generator is used.

Passwords are stored and checked by Supabase Auth. SOPCompass never stores or sees a stored password.

What we don’t do

• There is no additional application level or field level encryption of SOP content. Anyone with administrative access to the database can read it, which at SOPCompass is limited to the people who operate the service.
• There are no customer managed encryption keys.