Security is part of the product.

Defense in depth

We combine authenticated access, least-privilege authorization, protected server actions, database policies, private storage for sensitive files, encrypted connections through hosted providers, logging, and careful document and email workflows.

Account and application access

Supabase Auth identifies signed-in users. Subscription and application permissions are checked before protected features are used. Database Row Level Security is intended to keep each user's records and workspace data isolated, while owner and administrator privileges are limited to authorized accounts.

Use a unique, strong email account and device passcode. Never share verification codes or account sessions. Enable multi-factor authentication when available and report unexpected access promptly.

Data, files, and secrets

Sensitive employee photos, signatures, documents, and business records should be treated as confidential. Private files are intended to be protected by storage access policies and short-lived access where supported.

Supabase publishable configuration may appear in browser code, but service-role keys, database passwords, Resend API keys, and other privileged credentials must remain server-side and in protected environment settings. Never paste secrets into forms, issues, or public repositories.

Email, payments, and third parties

Resend is used for transactional delivery when email features are enabled. Google Play handles Work Pay Slip subscriptions, billing, renewals, cancellations, refunds, and payment-card information. We limit each provider to the information needed for its function and do not control third-party availability or security practices.

Secure development and operations

We review authorization boundaries, keep database migrations and application changes traceable, test critical workflows, investigate errors, and restrict administrative actions. Security controls are not a substitute for backups, careful recipient selection, current dependencies, or account protection.

Incident response

If we confirm a security incident, we will investigate, contain, preserve relevant evidence, remediate the issue, and provide notices required by applicable law. We may contact affected users through their account email or another appropriate channel.

Responsible disclosure

Report suspected vulnerabilities to info@isdigitaltech.com with the affected page, steps to reproduce, and a safe contact method. Please do not access, alter, download, or disclose another person's data. Good-faith reports are welcome; we may ask for additional details.

Shared responsibility

Security depends on IS Digital Tech, our providers, and every user. Keep devices and email accounts secure, verify recipients, maintain appropriate business backups, and only upload data you are authorized to handle. No service or transmission is completely risk-free.