Trust

Security

We’d rather describe our actual architecture plainly than claim a certification we don’t have. EnlightIn has not been independently audited or certified (e.g. SOC 2, ISO 27001) — if that changes, it’ll be stated here, not implied.

Account security

  • Authentication is handled by Supabase Auth — we never see or store your raw password.
  • Every page load revalidates your session server-side rather than trusting a stale client-side token.
  • You’re able to sign in with Google as an alternative to a password. [Add multi-factor authentication once it’s implemented].

Data protection

  • All traffic to EnlightIn is encrypted in transit (HTTPS/TLS), enforced with HSTS.
  • Our database uses Postgres Row Level Security — access rules are enforced at the database layer itself, not only in application code, so a bug in one page can’t accidentally expose another user’s private data.
  • Uploaded files (avatars, post images) are scoped per-user at the storage layer, with size and file-type limits enforced server-side.

Infrastructure

EnlightIn is built on Supabase (Postgres database, authentication, and file storage) and hosted on Vercel. We rely on these providers’ own infrastructure security rather than operating physical servers ourselves.

Video calls

Calls happen peer-to-peer over WebRTC directly between the two participants’ browsers. EnlightIn’s servers only relay the connection setup (signaling) — not the audio or video itself — and calls are never recorded or stored.

Application-layer protections

  • A security-focused Content Security Policy, X-Frame-Options, and related headers are set on every response.
  • Rate limiting on sensitive actions like posting, messaging, booking, and search.
  • Server-side input validation on identifiers and search text to prevent injection into database queries.

Access controls

EnlightIn does not have a public admin panel or backdoor access route. Internal access to production data is limited to what’s operationally necessary. [Describe your actual internal access policy once the team grows beyond the founders].

Monitoring and incident response

[Describe your actual monitoring/alerting setup and incident response process once one exists — don’t claim 24/7 monitoring or a formal incident response plan unless it’s real].

Responsible disclosure

If you’ve found a security vulnerability in EnlightIn, please report it to us privately rather than disclosing it publicly, and give us a reasonable window to fix it before sharing details elsewhere.

[Add a dedicated security contact email once one exists, e.g. security@yourdomain.com] — until then, use our contact form.