Security

Rohometric handles your financial data. We treat that responsibility seriously. This page describes the technical measures we use to protect it.

Encryption

In transit

All traffic between your browser and our servers is encrypted with TLS 1.2 or higher. API calls, file uploads, and authentication flows all travel over HTTPS — plain HTTP connections are automatically redirected.

At rest

Your data is stored in a PostgreSQL database managed by Supabase. Supabase encrypts all data at rest using AES-256 encryption on the underlying storage volumes.

Data isolation

Every database table that holds customer data is protected by Postgres Row-Level Security (RLS). RLS policies ensure that each authenticated user can only read and write their own rows — enforced at the database engine level, not just the application layer. Even if an application bug were to omit a WHERE clause, the database itself would block cross-tenant access.

Authentication

User authentication is handled by Supabase Auth, which supports email/password and Google OAuth. Passwords are hashed with bcrypt before storage — we never store or log plain-text passwords. Session tokens are short-lived JWTs refreshed automatically; the middleware validates every request.

Payment data

Rohometric does not collect, process, or store payment card data on its servers. The Service is currently free. If paid plans are introduced, payment processing will be handled by a PCI-DSS compliant third-party processor and card details will never touch our infrastructure.

Hosting and infrastructure

• Application hosting: Vercel, running on AWS edge infrastructure with automatic TLS and DDoS mitigation.
• Database hosting: Supabase (managed PostgreSQL), running on AWS in the ap-northeast-2 (Seoul) region.
• AI processing: AI summaries are generated by Anthropic’s Claude API. Only computed KPI values are sent — never raw uploaded files or personally identifiable information beyond what is in the KPI payload (business name, currency, period dates).

Backups

Supabase performs daily automated backups of the database. Backups are encrypted and retained on a rolling schedule. Point-in-time recovery is available on eligible plans.

Access controls

• Application secrets (database credentials, API keys, service role keys) are stored as encrypted environment variables in Vercel and are never exposed to the browser or included in client-side bundles.
• The Supabase service-role key is used only in server-side API routes — it is never sent to the client.
• Admin access is separated from customer access with its own authentication system, session tokens, and audit logging.

Deleting your account and data

To delete your account and all associated data, email privacy@rohometric.com from the email address registered on your account. We will verify your identity and delete all of the following within 30 days:

• Your user account and authentication credentials.
• All business profiles you created.
• All uploaded transaction data and computed KPIs.
• All reports, AI summaries, alert rules, and alert events.

Once deletion is complete we will confirm by email. Data in encrypted backups will be overwritten as part of the normal backup rotation cycle.

Vulnerability reporting

If you discover a security vulnerability, please report it responsibly by emailing security@rohometric.com. We will acknowledge receipt within 48 hours and aim to resolve confirmed issues promptly.