Encryption in transit and at rest
All connections to RenewOps use TLS 1.2+. Data at rest is encrypted by Supabase (hosted on AWS) using AES-256. No plaintext data is stored on disk.
Row-level security
Every database table enforces row-level security (RLS) policies. A query from one user account can never return another user's records — this is enforced at the database engine level, not just in application code.
Authentication
Authentication is handled by Supabase Auth (built on GoTrue). Sessions use secure, HTTP-only cookies with SameSite=Lax. Two-factor authentication (2FA) is supported and can be enabled in your account settings.
Security headers
Every response includes: Content-Security-Policy, Strict-Transport-Security (HSTS with preload), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, and Permissions-Policy.
Email reminders
Reminder emails are sent via Resend using our verified domain (reminders@renewops.app). We do not store email credentials on the client side. The sending process runs server-side only using a scoped API key.
Data portability
Export your full workspace as a CSV at any time from the Records page. No lock-in. If you request account deletion, all associated data is permanently removed within 30 days.
Infrastructure summary
| Hosting | Vercel (edge + serverless functions) |
| Database & auth | Supabase (AWS us-east-1) |
| Email delivery | Resend |
| TLS | TLS 1.2 / 1.3 enforced |
| Encryption at rest | AES-256 (AWS managed keys) |
| Session storage | HTTP-only secure cookies |
Responsible disclosure
If you discover a security vulnerability in RenewOps, please report it to support@renewops.app before public disclosure. We will acknowledge receipt within 48 hours and aim to resolve confirmed issues within 14 days.
We appreciate responsible disclosure and will credit researchers who report valid findings.
Questions about security? Contact us. See also our Privacy Policy.