Security Overview

Where your data lives

The database, login and files are hosted by Supabase in Ireland (European Union). The application runs on Vercel, with server functions in the United States.

Keeping organisations apart

Every workspace's records are separated in the database with row-level security, so one organisation cannot read or change another's ideas, files, members, evaluations or reports.

Access control

Roles decide who can move ideas through gates, record decisions or manage members. These rules are checked on the server, not just hidden on screen.

Data protection

Data is encrypted in transit (HTTPS) and at rest by our hosting providers. Passwords are stored only as secure hashes. Idea attachments and business documents are kept in private storage and opened through short-lived links. Profile photos are the exception: anyone with a photo's link can open it.

Uploads have size and file-type limits, and repeated sign-in or form attempts are limited.

Audit trail

Key actions, such as stage moves, decisions and membership changes, are recorded in an activity log so there is a history of who did what.

Reporting a security problem

If you find a security issue, please email support@thegrowthsystem.co.za. We'll respond promptly and won't take action against good-faith reports.