Infrastructure
- Hosting: deployed on Vercel with automatic TLS and edge caching.
- Database: Supabase (PostgreSQL) with row-level security policies ensuring data isolation between organisations.
- Authentication: managed by Clerk with support for multi-factor authentication, SSO, and session management.
- Payments: processed by Stripe. We never store card numbers or sensitive payment data on our servers.
Data Protection
- All data is encrypted in transit (TLS 1.3) and at rest.
- Supabase row-level security ensures each organisation can only access its own data.
- API routes validate authentication tokens on every request.
- Security headers (CSP, HSTS, X-Frame-Options) are enforced across the application.
Monitoring
- Error and performance monitoring via Sentry for real-time alerting.
- Product analytics via PostHog — no personal data is sent to third-party analytics.
Responsible Disclosure
If you discover a security vulnerability, please report it to security@horizonwatch.ai. We take all reports seriously and will respond within 48 hours.