Security

You can sign in to Polyconomic with email and password, or via Google OAuth. If you use a password, it is never stored in plain text. We hash all passwords using bcrypt with a cost factor of at least 12 before storing them.

If you use Google sign-in, no password is ever stored on our servers. Authentication is handled entirely by Google's OAuth infrastructure.

All sessions are managed with signed, server-verified tokens. Sessions expire after periods of inactivity and are invalidated on logout.

All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher. We do not support older, insecure TLS versions.

Data stored in our database is encrypted at rest using AES-256. Backups are also encrypted.

We never require or store wallet private keys or cryptocurrency exchange withdrawal permissions. We only request read-only API access where integrations support it.

Your transaction data is isolated at the database level using row-level security (RLS). This means that even if there were a query bug, your data could not be returned in a request for another user's data.

Internal access to production data is restricted to a small number of authorised engineers, requires multi-factor authentication, and is logged for audit purposes.

Polyconomic is hosted on Vercel (application layer) and Supabase (database). Both providers maintain their own security programmes, certifications, and physical security controls.

We use Supabase's managed Postgres infrastructure, which includes automated backups, point-in-time recovery, and encrypted storage. Supabase operates on AWS infrastructure.

Our application deployment pipeline uses branch protections, requires code review, and runs automated security checks on every deployment.

All payments are processed by Stripe. We do not store card numbers, CVV codes, or billing addresses on our servers. Stripe is PCI DSS Level 1 certified, the highest level of certification in the payment industry.

We store only your Stripe customer ID and subscription status, which we need to manage your account access.