Security
Only controls that exist in the running system. No invented certifications.
Authentication
Passwordless OTP via Supabase/GoTrue. Admin actions require staff email and AAL2.
Encryption
TLS on the public site and API. Application secrets live in server environment, not the frontend bundle.
Data isolation
User rows are scoped by authenticated user id. B2B tenants are a separate fail-closed sandbox.
Infrastructure
Production web and API run on a VPS behind Caddy. We do not claim SOC 2, ISO or Kubernetes.
Backups
Database backup policy is an operations control. We do not advertise a backup slogan unless the runbook is public.
Access control
Authorization is enforced on the API. Frontend route guards are not the permission layer.
Monitoring
Health endpoint and structured API logs. Internal status is not a sales page.
Incident handling
Payment, model and source incidents are handled internally. We do not publish infrastructure maps here.
Data deletion
Account deletion is available at /account/delete after authentication.
Responsible disclosure
Report issues to support@axelrodsoracle.ru. Do not send secrets in public issues.