Security & Trust

Endorsr is built with security as a foundational principle. We use a defence-in-depth approach combining encryption, access controls, audit logging, and continuous monitoring.

• Row-level security (RLS) enforced at the database level for all user data
• Service role keys restricted to Supabase Edge Functions — never exposed client-side
• Multi-factor authentication available for all accounts
• Session management with configurable expiry via Supabase Auth
• Principle of least privilege applied to all internal access

All content review actions, administrative changes, and sensitive operations are recorded in an immutable, append-only audit log. Each entry is hash-chained to prevent tampering. Audit logs cannot be modified or deleted — even by administrators.

• All user input validated server-side — client-side validation is UX only
• Rate limiting on auth endpoints, search, and API routes
• Content Security Policy (CSP) headers configured
• SQL injection prevented via parameterised queries (Supabase client)
• Dependencies monitored and updated regularly

See our Vulnerability Disclosure Policy for responsible disclosure guidelines. Contact [email protected].