Security & encryption

Encryption standards

Data in transit

All communications between your device and our servers use HTTPS (TLS), as set up by our hosting providers, Vercel and Supabase. Every API call, file upload and data sync is encrypted during transmission.

Data at rest

The emergency message and saved links are encrypted with AES-256-GCM, separately for each contact, when you activate the protocol. Documents are encrypted for each contact on paid plans. Each package uses a fresh content key, wrapped for each authorized contact with RSA-2048 (RSA-OAEP). A contact’s private key is itself stored encrypted, protected by a key derived from their PIN using industry-standard key derivation.

This is not end-to-end encryption: the encryption itself is done on our servers, which handle your content to encrypt it and to deliver alerts. End-to-end encryption is planned for a future version, and we are working on it.

Our servers generate each contact’s PIN and send it to them by email when they accept their role. In our database, PINs are stored only as cryptographic hashes: if a PIN is lost, we cannot restore access to data already encrypted for it.

Key management

Contact keypairs are generated in the contact’s browser when they accept their role, and the private key is stored only in encrypted, PIN-protected form. Recipients decrypt emergency messages and links directly in their browser. Documents are decrypted by our servers at download, once the contact’s PIN is checked. The database and file storage are also encrypted at rest by Supabase, including metadata such as timestamps and protocol status.

Infrastructure security

Data centers

Safety Checkpoint runs on the infrastructure of the providers listed in our privacy policy: Supabase for the database, the files and the server functions, Vercel for the website and the web app. Their data centers, physical security and certifications are theirs to describe, and they update them often: see Supabase’s security page and Vercel’s security page rather than a copy of them here.

Network security

Protection against denial-of-service attacks and other network-level filtering are those of our hosting providers, at their edge. On our side, PIN checks, sign-in and email sending are rate limited, and connections to the database use encrypted protocols.

Monitoring & logging

Our servers record access to emergency pages, PIN attempts, document downloads, protocol stops and changes to contacts. Automated monitoring alerts us when the service is unhealthy, when error rates or alert delivery failures rise, and when a scheduled test fails. These records are kept while your account exists and are deleted with it.

Access controls

Administrative access

Access to production systems (database, server functions, hosting) is limited to the people who run the service. In the app, administrative functions check the administrator role on the server before they act.

Customer data

The emergency message, saved links and documents are stored encrypted and are unlocked by contact PINs, which our database stores only as cryptographic hashes and which we cannot recover for you. Day-to-day operation relies on metadata that is not encrypted per contact, such as protocol status and timestamps; our servers handle your content to encrypt it and to deliver alerts. Every access to your emergency message, links and documents requires PIN verification, is rate limited, and is logged.

Audit trails

Access to emergency pages, PIN attempts, document downloads, protocol stops and changes to contacts are recorded by our servers. These records are kept while your account exists and are deleted with it. Sign-in records are kept by Supabase, our authentication provider, under its own retention rules.

Compliance & architecture

The regulations we follow and the architecture we chose.

• Provider certifications. The platforms we build on publish their own certifications and audit reports, and keep them up to date. We do not repeat them here: check Supabase and Vercel directly. They cover the platforms, not an audit of Safety Checkpoint itself.
• GDPR rights. Access, rectification, deletion, portability and objection, as set out in our Privacy Policy.
• CCPA rights. California residents can know, delete and opt out, as set out in our Privacy Policy. We never sell personal data.
• Envelope encryption architecture. The emergency message, saved links and documents are stored encrypted, and the keys that unlock them are protected by contact PINs, which our database stores only as cryptographic hashes. We do not offer PIN recovery.

Our security practices

Continuous security improvement through industry best practices.

Regular security audits

Security-focused development practices with thorough code review for critical features including authentication, encryption, and data access controls. An automated security test suite runs in CI every week, and an automated battery runs the full alert chain daily, up to the real reception of the alert in an inbox. Community-driven security through responsible disclosure.

Vulnerability management

Security patches for our dependencies are applied as advisories land. Changes are checked locally and by the automated test suites before they reach production.

Incident response

Automated monitoring alerts us when the service is unhealthy, when error rates or alert delivery failures rise, and when a scheduled test fails. If an incident ever affects your data, we notify you directly and publish what happened in the changelog. We report personal data breaches to the competent supervisory authority within 72 hours, as GDPR requires.