Security at ForgedHelix

• Encryption in transit. All traffic uses HTTPS with TLS 1.3, and HTTP Strict Transport Security (HSTS) is enforced across our domains.
• Where your data lives. Customer data is stored on Supabase-managed PostgreSQL hosted in the United States. Encryption of data at rest is provided by that managed platform.
• Payment data. Payments are processed by Stripe. ForgedHelix never receives or stores card numbers.
• Upload handling. Files are read in your browser and only the structured rows are sent to us; data you upload is validated on our servers before it is processed.
• Data retention. As described in our Privacy Policy, we delete your account and uploaded business data within 30 days of a verified request, except for records we are legally required to keep.

• Passwords are handled by our authentication provider (Supabase Auth) and stored only as salted hashes; ForgedHelix never sees them in plain text.
• Sessions use signed cookies that are validated on every request. Account approval, payment status, and account-active state are re-checked on each request, and sessions are revoked server-side at logout — so access can be withdrawn immediately.
• Access is role-based and least-privilege, and the administrative console sits behind a separate authentication boundary from the customer portal.
• Each customer’s data is isolated by a per-request authorization check on every operation that touches customer data. Database Row-Level Security is enabled on all customer-data tables as an additional layer of defense.

• A strict Content-Security-Policy and a modern set of security headers are served on every domain.
• Application secrets are never exposed to the browser.
• Every change runs through automated tests and a dependency security check before release, and dependencies are scanned automatically for known issues.

An internal 13-domain security audit was completed in July 2026, followed by baseline and verification penetration tests of the application. The most recent test (July 2026) found no unresolved findings above informational severity. We continue to test the application as it evolves. (These assessments are performed by ForgedHelix; we do not represent them as independent third-party audits.)

We maintain an incident-response plan covering detection, containment, recovery, and customer notification, and we log security-relevant account activity for auditing.