Security Policy

    Last updated: 31 October 2025

    Overview

    Teamsmiths builds security in from the start, with least-privilege access, audit logging and strict separation of environments. The measures below protect your data.

    Data Protection

    • Encryption in transit: All data transmitted uses TLS 1.2+ security protocols
    • Encryption at rest: Database encryption per Supabase PostgreSQL defaults
    • Access controls: Strong, unique credentials; secrets stored in secure environment variables, with a separate key for each kind of signed link
    • Backups: Automated daily backups with point-in-time recovery capabilities

    Application Security

    • Code review: Regular security reviews and testing
    • Dependency scanning: Automated vulnerability detection and patching
    • Webhook security: Signature verification for all incoming webhooks
    • Row-level security: Complete data isolation with automated enforcement
    • Role-based permissions: Admin/user separation with database-level policies

    Vulnerability Management

    Our vulnerability management process includes:

    • Triage within 1 business day of discovery
    • Remediation SLAs based on severity classification
    • Regular security testing and audits
    • Proactive monitoring for emerging threats

    Incident Response

    In the event of a security incident, we have established procedures to:

    • Monitor our systems and alerts for threats
    • Quickly identify and contain security threats
    • Assess and mitigate impact to systems and data
    • Notify affected customers without undue delay if personal-data breach is confirmed
    • Conduct post-mortem reviews within 10 business days
    • Implement corrective measures to prevent recurrence

    Subprocessors

    We work with trusted service providers who maintain high security standards:

    • Supabase: Database, storage, and serverless functions (PostgreSQL with encryption)
    • Lovable: Application hosting and development platform
    • Resend: Transactional email delivery
    • Mailgun (EU region): Receiving the enquiry emails forwarded to a Quote Desk
    • Stripe: Card and Direct Debit payments
    • OpenAI and the Lovable AI gateway: AI text generation in our older brief and proposal tools
    • MeetingBaaS: Meeting recording and transcription services (where enabled)
    • Analytics & CDN providers: Performance monitoring and content delivery

    All subprocessors are contractually obligated to maintain appropriate security measures and comply with applicable data protection regulations.

    Reporting Security Issues

    If you discover a security vulnerability, please report it to our security team immediately:

    Email: security@teamsmiths.ai

    We appreciate responsible disclosure and will work with you to address any issues promptly. We typically respond to security reports within 1 business day.