Security

Last updated: 10 June 2026

Architecture

Climatearray runs on managed infrastructure: the application is hosted on Vercel, and data is stored in Supabase (PostgreSQL on AWS). There are no self-managed servers. The science pipeline that produces hazard layers runs offline; the production platform serves pre-computed, non-personal climate data.

Data protection

• Encryption in transit — all traffic is served over TLS (HTTPS).
• Encryption at rest — databases and storage are encrypted at rest by AWS/Supabase.
• Tenant isolation — every customer table is protected by PostgreSQL row-level security scoped to organization membership; users can only reach rows belonging to their organization.
• Backups — automated daily database backups (Supabase Pro).

Authentication and access

• User authentication is handled by Supabase Auth; passwords are never stored by Climatearray directly.
• Programmatic access uses scoped API keys that are stored only as SHA-256 hashes — plaintext keys are shown once at creation and cannot be recovered.
• API requests are rate-limited per key and logged (endpoint, status, latency) for audit.
• Role-based access (owner / admin / member / viewer) governs organization administration.

Development practices

• All changes ship through pull requests gated by continuous integration (lint, automated test suite, production build).
• Secrets live in environment configuration (Vercel / GitHub Actions), not in the codebase.
• Database changes are applied through reviewed, version-controlled migrations.

Responsible disclosure

If you believe you have found a security vulnerability, email hello@climatearray.com with the details. We will acknowledge within 2 business days, and ask that you give us a reasonable window to remediate before public disclosure.