Security, built in from the start
We'd rather tell you exactly what's in place today than make broad claims. This page is kept up to date as our security posture evolves.
Authentication
Authentication is built on Supabase Auth with secure server-side session handling. Password resets use anti-enumeration behaviour, and a single sign-on flow lets you move between QrewTime products without re-entering your password on every domain.
Authorization
Every privileged action is checked server-side — access controls are never enforced only by hiding a button in the browser. Admin access requires an explicit platform role and is re-checked on every request.
Data protection
Our database uses Postgres Row Level Security on an expanding set of tables, and we're actively extending that coverage across the platform's shared account data as part of our ongoing organisation and entitlement work.
Secrets & infrastructure
Server-only credentials are never exposed to the browser. The platform is hosted on Vercel with Supabase as our database and auth provider.
What we're actively working on
We disclose gaps honestly rather than claim more than is true. Multi-factor authentication for accounts, a full administrative audit log, and complete Row Level Security coverage across every shared table are active workstreams, not yet complete.
Report a security issue
If you believe you've found a security issue, please email security@qrewtime.com — we take reports seriously and will respond as quickly as we can.