Security
How Client Posture is built and what we do — and do not — claim. We do not currently hold SOC 2 or ISO 27001 certifications; we will not invent them.
Infrastructure
- Hosting: Vercel (Next.js application and serverless/edge functions).
- Database & auth: Supabase (Postgres with row-level security, Auth, Storage).
- Payments: Stripe Checkout and Customer Portal. Card data never touches our servers.
- Email: Resend for transactional messages (magic links, receipts, product email).
Authentication
Users sign in with email magic links and optionally Google OAuth, both handled by Supabase Auth. Session cookies are HTTP-only. Admin routes are restricted to emails listed in server-side configuration.
Passive scanning only
Assessments use public signals: DNS-over-HTTPS, certificate transparency (e.g. crt.sh), RDAP/WHOIS-style registration data, TLS handshake metadata, and a normal GET to the homepage over HTTP/HTTPS. We do not port scan, brute-force paths, probe vulnerabilities, attempt logins, crawl beyond the homepage, or send exploit payloads.
Encryption & access
- All product traffic is served over HTTPS (TLS in transit).
- Secrets (Stripe, Supabase service role, webhook signing keys) live in environment variables on the host — never in client-side bundles.
- Database access for customer data is isolated per workspace with database row-level security (RLS) so one MSP cannot read another MSP's domains or reports.
- Operational access to production systems is limited to the Client Posture team who need it to run the product.
Subprocessors
We use the following processors to operate the Service. Details also appear in our Privacy Policy.
| Vendor | Role | Region |
|---|---|---|
| Vercel | Application hosting, edge delivery, and cookieless web analytics | United States (global edge) |
| Supabase | Postgres database, authentication, and file storage | United States (project region) |
| Stripe | Payment processing and billing portal | United States / global |
| Resend | Transactional email delivery | United States |
Deletion & contact
To request access, correction, or deletion of your account and scan data, email support@clientposture.com. Retention periods are described in the Privacy Policy.
Client Posture
7901 4th St N. STE 300, St. Petersburg, FL 33702