Security Policy

Infrastructure & Hosting

• Akangbou is hosted on Vercel; data is stored in Supabase (Postgres) with row-level security policies on application tables.
• Traffic is encrypted in transit with TLS, and we send HTTP Strict Transport Security (HSTS) and a Content Security Policy.
• Application secrets are kept in our hosting providers’ encrypted environment configuration, not in source code.
• Card data is entered on Stripe-hosted or Stripe-provided payment fields and never stored on Akangbou servers.

Application Security

• Authentication is provided by Supabase Auth; passwords are stored hashed by the provider.
• Sensitive endpoints are rate limited, and privileged administrative actions are recorded in an audit log.
• Sentry monitors runtime errors; error reports exclude cookies and authorization headers, and session replay (masked) runs only with consent.
• Continuous integration runs automated tests on changes before deployment.

Data Protection

• Access to records is restricted by database policies to the owning user or team, with narrowly scoped service access for platform operations.
• Our database provider maintains backups; deleted data may persist in backups until they expire on the provider’s schedule.
• Staff access to production data is limited to people who need it to operate and support the service.

Incident Response

We investigate suspected security incidents promptly, contain and remediate them, and document what happened. If an incident compromises personal information, we notify affected users and regulators as required by applicable breach-notification laws.

Vulnerability Reporting

Report suspected vulnerabilities to security@akangbou.com with reproduction steps and impacted endpoints (see also /.well-known/security.txt). Please give us a reasonable time to fix issues before public disclosure, do not access or modify other users’ data, and do not degrade the service. We will not pursue legal action against good-faith research that follows these rules.