Security is built into how Spheralytical runs the platform and the sites we host. This page summarises our approach. [Formal certifications such as ISO 27001 / SOC 2 are not yet held - state status honestly; do not claim certifications you do not have.]
Tenant isolation
The platform is multi-tenant with row-level security in the database: agency staff can only access their agency's data, and a client portal user can only access their own business's data. Access is enforced at the data layer, not just the application.
Encryption
- All traffic is served over HTTPS (TLS) with HSTS.
- Data is encrypted at rest by our database and hosting providers.
- Payment card data never touches our servers - it is handled by our PCI-compliant payment provider.
Infrastructure
- Hosting and content delivery on a global edge network (Vercel).
- Managed Postgres with automated backups and point-in-time recovery (Supabase).
- Baseline security headers on every response (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS).
Access control
- Authenticated access with role-based permissions (owner / admin / member / client).
- Least-privilege service credentials; secrets stored outside source control.
Monitoring and uptime
Sites and the platform are monitored for availability. Our target is high availability with rapid recovery; status and incidents are communicated to affected clients.
Reporting a vulnerability
If you believe you have found a security issue, please email us () with details. We investigate all reports and will not pursue good-faith research.