How we keep your data safe.
Encryption, access controls, and the controls behind them — written for a real auditor, not a marketing site.
Last updated 2026-10-20
This page documents the security measures SONAR has in place. It is written to meet the Annex II requirement of the GDPR Standard Contractual Clauses and the Annex II of our DPA.
1. Encryption
All web traffic is served over TLS 1.2+ with modern ciphers. Data at rest in Supabase and Render is encrypted at the platform layer (AES-256). Weekly database backups are encrypted with AES-256 before they leave the database. Third-party API keys in the app_settings table are protected by database access controls (service role only); they are not separately encrypted at the application layer.
2. Authentication and access
Customer authentication uses Supabase Auth (bcrypt-hashed passwords). Admin consoles on every third-party vendor (Supabase, Render, GitHub, Anthropic, Bright Data, domain registrar) require multi-factor authentication. The SONAR backend checks the identity and role behind every request, including a server-side check on every admin route, and Supabase Row Level Security blocks direct database access from browsers.
3. Tenant segregation
Every customer's data is scoped by user and profile_id. The backend filters every query by the signed-in user's own profiles, and Row Level Security policies stop a browser from reading another customer's rows directly. The backend itself connects with a service role that bypasses Row Level Security, so tenant isolation rests on those backend checks.
4. Backup and disaster recovery
Supabase keeps automated daily backups for 7 days. In addition, a weekly logical backup, encrypted with AES-256, is stored outside Supabase in a private GitHub repository for 12 weeks, and restores are tested against a separate staging copy. Application servers are stateless and redeployable from source within minutes.
5. Logging and monitoring
Application logs are kept by our hosting provider (Render) for the period its plan sets; usage records in our database are kept for 90 days. Error reports are stored with email addresses, IP addresses and tokens removed, and deleted 90 days after the error was last seen. Alerts on key failure modes (new or spiking errors, circuit breakers, Supabase errors, failed scheduled jobs) are pushed to an admin Telegram channel; they contain no personal data.
6. Vulnerability disclosure
Suspected vulnerabilities may be reported to security@getsonar.report. Please allow 90 days before public disclosure. We commit to acknowledging reports within 48 hours. See /.well-known/security.txt for machine-readable details.
7. Breach response
SONAR notifies affected customers within 72 hours of confirming a personal-data breach. Supervisory authorities are notified per GDPR Art. 33 within the same window.
8. Third-party risk management
Every subprocessor is vetted for a published security posture before onboarding. The current list is at /legal/subprocessors.
9. Certifications
SONAR does not currently hold a SOC 2 or ISO 27001 certification. Current status is reflected here when it changes; email legal@getsonar.report for our answers to security questionnaires.
10. Contact
Security matters: security@getsonar.report · Compliance / legal: legal@getsonar.report