Security Policy

Last updated: August 16, 2026

At CreatorHero IO, security is not an afterthought - it's fundamental to everything we build. This Security Policy outlines our comprehensive approach to protecting your data, maintaining system integrity, and ensuring the confidentiality of your business information.

Encryption in Transit

All data transmitted between your browser and our servers is encrypted using:

• TLS 1.3 - The latest and most secure version of Transport Layer Security
• HTTPS Everywhere - All connections are forced to use HTTPS
• HSTS (HTTP Strict Transport Security) - Prevents downgrade attacks

Encryption at Rest

Your data is encrypted when stored in our databases:

• AES-256 Encryption - Military-grade encryption for all stored data
• Encrypted Backups - All backups are encrypted using the same standards
• Database-Level Encryption - Supabase PostgreSQL encryption enabled
• Field-Level Encryption - Sensitive fields (passwords, API keys) have additional encryption layers

Row-Level Security (RLS)

We implement PostgreSQL Row-Level Security to ensure data isolation:

• User Isolation - Users can only access their own data
• Project Isolation - Project data is restricted to authorized users
• Workspace Boundaries - Team data is isolated by workspace
• Database-Level Enforcement - Security cannot be bypassed at the application layer

Authentication

• Secure Password Storage - Passwords are hashed using bcrypt with salt
• OAuth 2.0 Support - Secure authentication via Google and other providers
• Session Management - Secure session tokens with automatic expiration
• Multi-Factor Authentication (MFA) - Optional 2FA for enhanced security (coming soon)

Authorization

• Role-Based Access Control (RBAC) - Granular permissions based on user roles
• Principle of Least Privilege - Users only get access to what they need
• API Key Security - Scoped API keys with limited permissions
• Token Expiration - Automatic token refresh and expiration

Hosting & Network

We leverage enterprise-grade infrastructure:

• Supabase Platform - Built on AWS with SOC 2 Type II compliance
• Geographic Distribution - Data centers in multiple regions for redundancy
• DDoS Protection - Automatic mitigation of distributed denial-of-service attacks
• Rate Limiting - Distributed rate limiting using Redis to prevent abuse
• Web Application Firewall (WAF) - Protection against common web vulnerabilities

Database Security

• Automated Backups - Daily encrypted backups with 30-day retention
• Point-in-Time Recovery - Ability to restore data to any point within 7 days
• Database Monitoring - Real-time monitoring for anomalies
• Query Performance Indexes - 12 optimized indexes for security and performance
• Connection Pooling - Secure connection management to prevent exhaustion

Application Security

• Input Sanitization - All user input is sanitized to prevent injection attacks
• Prompt Injection Prevention - AI inputs are validated and sanitized
• CORS Configuration - Strict Cross-Origin Resource Sharing policies
• Content Security Policy - CSP headers to prevent XSS attacks
• Dependency Scanning - Automated vulnerability scanning of npm packages

Integration Security

Third-party integrations are secured with multiple layers:

• OAuth 2.0 Flows - Standard OAuth for Slack, Gmail, etc.
• Encrypted Credentials - API keys and tokens encrypted at rest
• Secret Masking - Sensitive values are masked in logs and UI
• Webhook Verification - HMAC signature verification for incoming webhooks
• Integration Audit Log - All integration changes are logged
• Scoped Permissions - Integrations only request necessary permissions

API Security

• Authentication Required - All API endpoints require valid authentication
• Rate Limiting - Per-user rate limits prevent API abuse
• Request Validation - All requests validated against schema
• Idempotency - Webhook events tracked to prevent duplicate processing

Real-Time Monitoring

• Sentry Error Tracking - Real-time error monitoring on frontend and backend
• Structured Logging - Comprehensive logs without PII exposure
• Performance Monitoring - Track query performance and system health
• Uptime Monitoring - 24/7 monitoring of system availability
• Anomaly Detection - Automated detection of unusual patterns

Incident Response

We have a structured incident response process:

• Detection - Automated alerts for security incidents
• Containment - Immediate isolation of affected systems
• Investigation - Root cause analysis and impact assessment
• Resolution - Fix implementation and verification
• Communication - Transparent notification to affected users
• Post-Mortem - Document lessons learned and preventive measures

Data Breach Notification

In the unlikely event of a data breach, we are committed to transparency and rapid response:

• 72-Hour Notification - Affected users will be notified within 72 hours of discovery
• GDPR Compliant Process - We follow GDPR Article 33 & 34 requirements
• Clear Communication - Plain-language explanation of what happened and what to do
• Supervisory Authority - EU data protection authorities notified if required
• Full Transparency - Public disclosure of incident details and remediation steps
• Documented Procedures - Complete breach response plan maintained and regularly updated

We have a comprehensive Data Breach Response Plan that outlines our detection, assessment, containment, and notification procedures.

Data Protection Compliance

• GDPR Compliance - European Union data protection standards including data portability and 72-hour breach notification
• CCPA Compliance - California Consumer Privacy Act requirements
• Data Processing Agreement - Available upon request for enterprise customers
• Privacy by Design - Privacy considerations in all feature development

Security Standards

• OWASP Top 10 - Protection against common web vulnerabilities
• Security Best Practices - Following industry-standard security guidelines
• Regular Security Audits - Periodic security assessments
• Penetration Testing - Annual third-party security testing (planned)

Secure Development Lifecycle

• Code Reviews - All code changes reviewed before deployment
• Automated Testing - 1,172 unit tests (23 skipped) and 43 end-to-end tests, with dedicated coverage of security-critical code paths (auth, RLS policies, rate limiting, webhook verification)
• Static Analysis - ESLint with security rules (zero warnings policy)
• Dependency Updates - Regular updates to patch vulnerabilities

Deployment Security

• CI/CD Pipeline - Automated builds with security checks
• Environment Separation - Strict separation of dev/staging/production
• Secret Management - Secrets stored in Supabase Vault, never in code
• Rollback Capability - Instant rollback for problematic deployments

Data Retention & Deletion

Retention Policies

We implement tier-based data retention:

• Starter Tier - 7 days of activity data retention
• Pro Tier - 30 days of activity data retention
• Soft Deletes - Data marked as deleted before permanent removal
• Hard Deletes - Permanent removal of activity data past its retention period, run as a scheduled operational task

User-Initiated Deletion

• Account Deletion - Users can delete their account at any time
• Data Portability - Export all your data before deletion
• 90-Day Grace Period - Account recovery possible within 90 days
• Permanent Deletion - Complete removal after grace period

Responsible Disclosure

We welcome security researchers to report vulnerabilities responsibly. If you discover a security issue, please:

• Do Not publicly disclose the vulnerability before we've had a chance to address it
• Email support@creatorhero.io with details
• Provide steps to reproduce and potential impact
• Allow us reasonable time to fix the issue (typically 90 days)

We commit to:

• Acknowledge your report within 48 hours
• Keep you informed of our progress
• Credit you in our security acknowledgments (if desired)
• Not take legal action against good-faith security research

Security Updates

We continuously improve our security posture. Check our changelog and security bulletins for the latest updates:

Contact Security Team

For security-related questions or concerns, please contact us at: