Security
Last updated: August 2026
Uniform Builder holds brand assets, designs, team rosters, and order data for the organizations that use it, so security is part of how the platform is built rather than something added afterwards. This page documents the controls that are actually in place today. Where we do not have something, such as a formal SOC 2 or ISO 27001 certification, we say so plainly rather than implying otherwise, and we update this page as the platform changes.
Authentication and Access
Authentication is handled by Supabase Auth using signed JWTs held in secure, HTTP-only cookies, so session tokens are not readable by page scripts. You can sign in with email and password, a one-time magic link, or a supported OAuth provider (Google, GitHub, X). Time-based one-time password (TOTP) two-factor authentication is available on every account from your settings, and access to our internal super-admin tooling requires an enrolled second factor plus a fresh step-up challenge on top of a valid session. Sign-in, sign-up, magic link, and password reset forms are protected by Cloudflare Turnstile to blunt automated credential attacks. We never store your password in a readable form: credential storage and hashing are handled inside Supabase Auth.
Tenant Isolation
Organization data is separated inside the database itself using PostgreSQL row level security. Policies are attached to the tables that hold designs, quotes, rosters, colors, assets, and organization membership, so a query made with your session can only return the rows your membership entitles you to, regardless of what the application asks for. Within an organization, roles (owner, admin, producer, member) gate what a member can see and change. The service role key that bypasses these policies is used only server-side for background work such as Stripe webhooks and queued AI jobs, and is never shipped to the browser.
Encryption
All traffic is served over HTTPS, and we send HTTP Strict Transport Security with a two-year max-age, includeSubDomains, and preload, so browsers refuse to fall back to plain HTTP. Data at rest, covering the PostgreSQL database and uploaded files in object storage, is encrypted by our managed infrastructure providers. Card data is never encrypted by us because it never reaches us at all (see Payments).
Application Security
Every API route declares its authentication model explicitly, and request bodies are validated against Zod schemas at the boundary before any logic runs. Error responses are standardized and never expose stack traces in production. Rate limits are enforced per route in middleware, with tighter buckets on public endpoints (contact, quote email, feedback) and on routes that spend money (AI generation, vectorization, background removal, email sending). Cross-origin requests are restricted to our own origin rather than a wildcard. Our image and font proxies fetch only from a host allowlist, with manual redirect handling and size caps, so they cannot be turned into a path into internal networks. Responses carry a Content Security Policy, X-Content-Type-Options nosniff, X-Frame-Options DENY, Referrer-Policy, and a restrictive Permissions-Policy. The public design viewer is the one surface that may be embedded in your own site, and that embedding can be restricted to an allowlist of parent origins.
Payments
Subscriptions and purchases run through Stripe Checkout. Card numbers are entered into Stripe's own hosted fields and never pass through, or get stored by, our servers or our database; we hold only Stripe identifiers and subscription status. Incoming Stripe webhooks are verified against the endpoint signing secret before they are processed, and every payment event is written to a structured audit log.
Your Designs and AI Processing
Uploaded logos, artwork, and generated assets are stored in access-controlled buckets, and every stored object is tracked in a registry so its lifecycle is auditable rather than guessed at. AI features send only the prompt and the image data needed to fulfill your request to the relevant model provider, and prompts pass a content safety check before a job runs. We do not use your designs, your logos, or your customers' data to train AI models. Protected 3D product models are delivered through an authenticated endpoint rather than sitting behind a public URL.
Infrastructure and Operations
The application runs as a container on managed cloud infrastructure, with managed PostgreSQL and object storage on Supabase, including automated backups taken by the provider. Deployments are built and shipped by an automated CI/CD pipeline from version-controlled source, so what runs in production corresponds to a reviewed commit. Secrets live only in the pipeline's protected variable store and in runtime environment configuration, never in the repository. Server-side flows emit structured logs, and application errors in production are captured in Sentry for triage. Access to production infrastructure is limited to the operators who need it.
Compliance and Certifications
Uniform Builder does not currently hold a SOC 2 Type II or ISO 27001 certification, and we will not imply that it does. The platform is built on providers that are certified for the layers they operate: Supabase and its underlying AWS infrastructure for the database and storage, Stripe as a PCI DSS Level 1 service provider for payments, and our cloud hosting provider for compute. Uniform Builder is operated from Western Australia and handles personal information in line with the Australian Privacy Principles; our Privacy Policy covers what we collect, how long we keep it, and how to request export or deletion. We are happy to complete security questionnaires and to sign a data processing agreement. Contact [email protected].
Responsible Disclosure
If you believe you have found a vulnerability, email [email protected] with enough detail to reproduce it. We aim to acknowledge reports within two business days and to keep you informed until the issue is closed. Please test only against your own account and data, avoid automated scanning that degrades the service for other users, and give us a reasonable window to remediate before disclosing publicly. We do not run a paid bug bounty at this time, but we are glad to credit reporters who want to be named.