Security at theguests.app

Postgres Row-Level Security (RLS) is enabled on every workspace-scoped table. Even with a leaked anon key, no client can read or write rows outside their own workspace.

• RLS policies enforced at the database, not just the app layer.
• Roles checked via security-definer functions to prevent recursive policies.
• Workspace owner is the only role authorised to delete or export.

All traffic is served over TLS 1.3 with HSTS preload. Data at rest is encrypted with AES-256 by the underlying managed Postgres service.

• TLS 1.3, HSTS preload, X-Frame-Options DENY.
• AES-256 at rest via Lovable Cloud (Supabase).
• Daily automated backups, 7-day point-in-time recovery.

TOTP-based two-factor authentication is available for every role and strongly recommended for workspace owners. Configurable from Settings.

• Standard TOTP (Google Authenticator, 1Password, Authy, …).
• Owners get a banner reminder until 2FA is enabled.
• Phone factor intentionally not exposed at the door scanner.

Every privileged action — invites, role changes, deletes, exports, scans — writes to an append-only audit_log table with workspace + actor + payload, retained 365 days.

• Visible to managers + owners under /audit.
• Includes IP + user-agent for sensitive actions.
• Right-to-delete leaves a final delete row for non-repudiation.

The app runs on a serverless edge runtime with per-IP and per-token rate limits on every public endpoint. Nothing user-facing speaks directly to the database.

• Public endpoints (/g/$token, /api/public/*) bucket-rate-limited.
• All write paths go through SECURITY DEFINER RPCs that re-check authorisation.
• No long-lived service-role keys shipped to the browser.

We are GDPR-compliant by design: portability, erasure and access requests are all self-serve from Settings. Customers can sign our DPA in one click.

• Sub-processors: Lovable Cloud (Supabase, EU), Cloudflare, Resend.
• Standard Contractual Clauses for any non-EU transfer.
• 72-hour breach notification commitment.