Security

Infrastructure

Database and storage at Supabase, European Union region, encrypted at rest. Application hosted on Vercel with mandatory TLS.

Data isolation

Every row in the database is protected by row-level security rules (RLS). A user can only read their own data and what others explicitly published.

Authentication

Hashed passwords (bcrypt), magic link and OAuth sign-in. Time-limited sessions.

Payments

No card data passes through our servers. Stripe handles payment, PCI DSS level 1 certified.

AI providers

Data sent to AI providers is limited to what is necessary and is not used to train their models.

Report a vulnerability

Write to security@wardrobio.com. We answer within 72 hours and publicly thank researchers who wish it.