This page is maintained by Approfits to describe the security controls currently operating in EmailBot KH. It is not an independent audit or certification.

Data in transit

• All web and mobile traffic is served over HTTPS (TLS 1.2+).
• The native iOS and Android apps load the production web origin ( https://emailbot.approfits.com) and reject cleartext / mixed-content requests in release builds.
• OAuth callbacks (Gmail and others) are restricted to an allow-listed set of origins.

Data at rest

• Primary data is stored in Supabase Postgres with disk-level encryption provided by the underlying cloud provider.
• SMTP credentials are encrypted with AES-GCM before being written to the database; the encryption key is stored as a managed secret, not in the application database.
• Backups are managed by Supabase with point-in-time recovery on the production project.

Authentication & access

• User authentication uses Supabase Auth with email + password and OAuth providers. Sessions are issued as short-lived JWTs.
• Row-Level Security (RLS) is enabled on every tenant-bearing table. Tenant scope is enforced by a RESTRICTIVE policy (tenant_scope_enforce) in addition to the role-based permissive policies.
• Roles are stored in a dedicated user_roles table and checked through a SECURITY DEFINER function — never trusted from client-side state.
• Admin actions are written to an append-only audit_logs table.

Push notifications & mobile

• Push notifications go through a dispatcher that enforces per-user quiet hours and category preferences before delivery.
• Notification deep links are normalized to allow-listed hosts and schemes before navigation — arbitrary URLs from a push payload will not open.
• The native shell ships bundled assets in production builds; no live-reload server URL is embedded in store binaries.

Operational controls

• Every edge function declares an explicit verify_jwt setting; internal cron functions require a signed x-cron-secret header.
• Continuous integration runs a sensitive-grants regression check, tenant-isolation RLS tests, and a production-readiness guard on every pull request.
• Secrets are stored in the Supabase Vault and never committed to the repository.

Reporting a vulnerability

If you believe you have found a security vulnerability, please email security@emailbot.approfits.com. Please do not file public GitHub issues or post to community forums for security topics. We aim to acknowledge reports within 2 business days.

Please include enough detail to reproduce the issue (URLs, request payloads, accounts used). We will not pursue legal action against researchers who follow this responsible disclosure process.