How we handle your data.
Companion to the privacy policy. Where the privacy policy answers what we collect and why, this page answers how it's protected.
In transit
Everything is HTTPS end-to-end. HTTP is redirected. Certificates are Let’s Encrypt via Vercel; renewal is automated.
At rest
Supabase (Postgres + auth) encrypts at rest with AES-256. Vercel Blob objects are encrypted at rest by the underlying store. Environment variables (Stripe keys, Supabase service role, MakeSplat token) are encrypted on Vercel and only decrypted at function invocation.
Passwords
Hashed by Supabase using bcrypt at cost factor 10 — industry standard. We never see cleartext passwords, ours or yours.
Card data
Handled entirely by Stripe. We store a Stripe customer id and a subscription status; we never see card numbers, CVCs, or billing addresses.
Row-level security on every table
Every query — whether from our Node code, a Supabase browser client, or a direct REST call — is filtered through Postgres RLS policies. Workspace A cannot see Workspace B’s tours, leads, or notifications even at the database level.
Role-based UI + API gates
Team-plan workspaces have four roles: owner / admin / agent / viewer. Enforced at both the RLS layer and the API-route layer so a compromised client can’t bypass by direct request.
Service-role usage
The Supabase service-role key bypasses RLS. We only use it in server-only code paths for legitimate cross-workspace reads (public tour URL resolution, Stripe webhook mutation). Never exposed to the browser.
Cron endpoints
/api/cron/* is authenticated via CRON_SECRET on the Authorization header. No fallback — cron is refused if the secret is not set or doesn’t match. Query-string secret is not accepted (would leak in access logs).
Primary Postgres
Supabase, region ca-central-1. All profile, tour, lead, event, and workspace data.
Video + reconstructed files
Raw walkthrough videos live on Vercel Blob (US multi-region) until 60 days after successful reconstruction, then automatically deleted. Reconstructed .ply files stay on Vercel Blob while a subscription is active, plus 90 days after lapse.
Reconstruction processing
MakeSplat (US). Your video is transmitted to their infrastructure via a presigned Cloudflare R2 upload URL, processed for ~20 minutes, and returned as a .ply. MakeSplat holds the source until you request deletion or 30 days pass, whichever is first.
Payments
Stripe (US). Only Stripe customer id + subscription state is mirrored to our database; no card material.
Monitoring
Every runtime error is captured to Sentry with source maps. We run a live liveness probe visible at /status. Cron failures surface in Sentry too — not silently swallowed.
Vulnerability reports
Email hello@volumevirtual.com with a proof-of-concept and reproduction steps. We reply within one business day. No bounty program yet — but we credit reporters in the changelog with permission.
Backups
Supabase Pro handles daily automated backups with 7-day retention. We take a weekly logical dump to a separate storage account as belt-and-suspenders.
Compliance status
Not SOC 2 certified yet — early-stage single-founder company. Custom-tier enterprise customers can request our current SOC 2-readiness posture + DPA template.
Questions we haven't answered here? Email hello@volumevirtual.com.