Security Posture
Detailed technical documentation of how Aegis Firma stores, processes, and protects your data. We publish this for enterprise procurement reviews and security-conscious buyers.
Last updated: April 2026 · Version 1.0
Encryption
| Layer | Algorithm | Key Management |
|---|---|---|
| Data at rest (database) | AES-256 | AWS KMS managed by Supabase |
| Data in transit | TLS 1.3 (TLS 1.2 minimum) | Let's Encrypt via Cloudflare |
| Password storage | bcrypt (cost factor 10+) | N/A — one-way hash, never reversed |
| Team vault passwords | AES-256-GCM (client-side) | PBKDF2-SHA-256 250k iterations; derived from master password; never sent to server |
| Session tokens | JWT RS256 | Supabase Auth RSA keypair, rotated automatically |
| E-signature auth tokens | CSPRNG hex (48 bytes) | Generated per signer, stored hashed |
| NPS survey share tokens | CSPRNG hex (32 bytes) | Generated per survey response |
Sub-processors
All third parties who may process your data. Aegis Firma does not sell or share your data for advertising. Sub-processors are selected for their compliance posture and DPA availability.
| Sub-processor | Purpose | Data accessed | Region | DPA |
|---|---|---|---|---|
| Supabase | PostgreSQL database, auth, storage | All customer data (encrypted at rest) | EU (Europe West) / US East | ✓ |
| Cloudflare | CDN, WAF, edge hosting, DDoS mitigation | HTTP request metadata (IP, headers). Not application data. | Global edge (30+ countries) | ✓ |
| LemonSqueezy | Payment processing, subscription billing | Billing email, subscription plan, payment method (tokenized) | US | ✓ |
| Resend | Transactional email (invites, alerts, summaries) | Recipient email addresses, email content | US / EU | ✓ |
All sub-processors have Data Processing Agreements in place. Sub-processor list is reviewed quarterly.
Data Residency
Primary data location
Customer data is stored in Supabase's EU (Europe West) region by default, hosted on AWS infrastructure. Data does not leave the EU region except:
- • Resend (email) — recipient addresses and transactional email content
- • LemonSqueezy (payments) — billing metadata only, US region
- • Cloudflare CDN — static assets only, no application data
Enterprise customers with specific data residency requirements (US-only, UK, etc.) may contact us to discuss custom deployment options. Default region selection follows GDPR requirements for EU data subjects.
Incident Response
< 4 hours
Detection target
From incident start to detection via monitoring alerts
< 2 hours
Containment target
From detection to isolation of affected systems
72 hours
GDPR notification SLA
Supervisory authority notified within 72h of confirmed breach
We maintain an incident response runbook covering: detection (automated monitoring alerts from Cloudflare + Supabase), containment (session invalidation, API key rotation, RLS policy lockdown), eradication (patching + re-deploy), recovery, and post-incident review. Customer notification follows GDPR Art. 33/34 requirements — we notify affected users within 72h of confirming a breach affecting their personal data.
Backup & Recovery
| Item | Frequency | Retention | RTO | RPO |
|---|---|---|---|---|
| Database (Supabase) | Daily automatic | 7 days (free), 30 days (Pro) | 4 hours | 24 hours |
| File storage (Supabase Storage) | Daily automatic | 7 days | 4 hours | 24 hours |
| Application code | Git (every commit) | Indefinite (GitHub) | 30 minutes | Zero (code) |
| Cloudflare configuration | Git-controlled (IaC) | Git history | 30 minutes | Zero |
RTO = Recovery Time Objective (how quickly we restore service). RPO = Recovery Point Objective (maximum data loss window). Restore tests are planned quarterly.
Access Controls
- ✓Production database access: Supabase dashboard credentials protected by MFA. Only the founder has production access.
- ✓Cloudflare account: MFA enforced. API tokens are scoped with minimum necessary permissions.
- ✓GitHub: MFA enforced. Branch protection on main branch — no direct pushes, CI must pass.
- ✓LemonSqueezy / Resend / Cloudflare accounts: MFA enforced. API keys stored as environment secrets only.
- ✓Service accounts: Each sub-processor has its own scoped API key. No shared credentials between services.
- ✓Application access: Role-based (owner/admin/member/viewer) enforced by Row-Level Security at the database level, not just application code.
- ✓Access review: Quarterly review of all service accounts and API keys. Unused keys are revoked.
Personnel & Access
Honest disclosure
Aegis Firma is currently a solo-founder company. The founder is the only person with production access. Contractors and future employees will sign NDAs, complete security awareness training, and be granted minimum-necessary access. All production access requires MFA.
We do not perform formal background checks at this stage. If your procurement requires background check attestation, please contact us to discuss alternative assurances.
Security Program Overview
Security Scan Summary
We publish a summary of our automated security scans each quarter. These are not a substitute for a third-party penetration test but demonstrate our active security hygiene.
| Scan type | Last run | Findings | Status |
|---|---|---|---|
| OWASP ZAP (web app) | April 2026 | 0 High, 0 Critical | ✅ Clean |
| Semgrep SAST | April 2026 | 0 Critical, 2 Info | ✅ Passing |
| npm audit + OSV | April 2026 | 0 High, 0 Critical | ✅ Clean |
| Mozilla Observatory | April 2026 | Grade: A | ✅ A grade |
| Custom attack tests (45) | April 2026 | 0 exploitable | ✅ All pass |
| Gitleaks secret scan | April 2026 | 0 secrets found | ✅ Clean |
| Third-party pentest | Not yet performed | — | ⚠️ Pending (planned 2027) |
Dependency Management
We track all software dependencies and scan for vulnerabilities daily using npm audit and OSV Scanner. Key dependencies and their security posture:
Next.js 14 (Web framework)
Maintained by Vercel, rapid security patching
Supabase JS (Database client)
Parameterized queries by default
Zod (Input validation)
Schema validation on all inputs
Jose (JWT handling)
Standards-compliant, RS256 algorithm enforcement
Tailwind CSS (Styling)
No runtime JS, no attack surface
Lucide React (Icons)
Static SVG, no network requests
Full SBOM (Software Bill of Materials) in CycloneDX format is available upon request for enterprise customers.
Change Management
How code reaches production:
- 1
Development
Code written in feature branches. TypeScript enforces type safety. Zod validates all runtime inputs.
- 2
Self-review
Solo founder reviews all changes against a security checklist before merging: auth check present, RLS applied, Zod schema complete, no secrets in code.
- 3
Automated CI
npm run build + TypeScript compilation + Semgrep SAST + npm audit. Build fails on type errors or critical security findings.
- 4
Staging preview
Cloudflare Pages generates a unique preview URL for every commit. Tested before promotion to production.
- 5
Production deploy
Merge to main triggers Cloudflare Pages build and deploy. Zero-downtime. Automatic rollback if build fails.
- 6
Post-deploy
Automated smoke tests. Monitoring alerts for error rate spikes. New migration runs sequentially via Supabase migration runner.
Uptime & Availability
Real-time uptime and incident history is available on our public status page. Aegis Firma is hosted on Cloudflare Pages' 300+ city global network with 99.99%+ SLA from Cloudflare. Supabase provides 99.9% SLA for database availability.
Customer Data Handling
| Data type | Retention | Deletion SLA | Export format |
|---|---|---|---|
| Compliance records, documents | Duration of subscription + 30 days | 30 days after account closure | JSON, CSV |
| User account data (email, name) | Duration of subscription + 30 days | 30 days after account closure | JSON |
| Audit logs | 2 years (for compliance purposes) | After retention period | JSON, CSV |
| Payment records | As required by law (7 years) | Cannot delete — legal requirement | Via LemonSqueezy |
| Security logs (IP, access) | 90 days | Automatic after 90 days | N/A |
To request deletion or export of your data, email privacy@aegisfirma.com. Requests are fulfilled within 30 days (GDPR requirement).
AI Training Data Policy
Your data never reaches a third-party AI provider.
- ✓Aegis Firma does not use customer data to train, fine-tune, or improve any AI model.
- ✓Document generation runs on static, deterministic templates. Your organisation's content is never sent to a third-party AI provider at request time.
- ✓There is no per-customer AI API call anywhere in the product — the same input always produces the same output.
- ✓Because nothing leaves for an external AI provider, there is no AI-provider retention, no AI-provider training exposure, and no AI sub-processor to vet.
CSA CAIQ Self-Assessment
We have completed an internal CAIQ v4 (Consensus Assessments Initiative Questionnaire) self-assessment. The full assessment is available upon request for enterprise procurement teams and can be shared under NDA.
Application & Interface Security
Partial
Input validation, XSS protection, CSRF mitigation implemented. No formal SDLC process yet.
Audit Assurance & Compliance
Partial
Internal audit logs maintained. No third-party audit yet.
Business Continuity
Partial
Daily backups, documented RTO/RPO. No formal DR test yet.
Change Control
Implemented
Git-controlled, CI gates, branch protection, staged rollout.
Data Security
Implemented
AES-256, TLS 1.3, RLS, data classification implemented.
Encryption & Key Management
Implemented
All data encrypted at rest and in transit. Client-side vault encryption.
Full CAIQ v4 questionnaire available to enterprise prospects. Contact sales@aegisfirma.com. We plan to submit to the CSA STAR Registry (free self-assessment level) by Q3 2026.
Security questions?
We're transparent. Ask us anything about our security practices.