Trust & Security

Email + password authentication with Have I Been Pwned breach checks on every signup and password change. Google SSO is supported. SAML SSO is available for organizations on the enterprise plan.

Authorization uses role-based access (admin, quality approver, inspector, member) stored in a dedicated user_roles table separate from the user profile to prevent privilege escalation.

Every database table enforces Row Level Security. Reads and writes are scoped to the channel members, organization members, or specific authorized roles required by that data.

Data in transit is protected by TLS 1.2+. Data at rest is encrypted by the underlying managed cloud database.

Sensitive message bodies flagged as containing PHI/PII are additionally encrypted at the application layer with AES-256-GCM and decrypted only for authorized viewers, with every reveal recorded in an immutable phi_reveal_log.

File attachments are stored in private buckets and served exclusively via short-lived signed URLs.

Electronic signatures require password re-authentication, capture the signer's name, intent, and meaning, and write a SHA-256 hash of the signed record content. Signatures are immutable and linked to the specific record version that was signed.

Every controlled record snapshots a new version with its own content hash on every change. Version history is append-only.

Channels under legal hold block message deletion and edits at the database level via a trigger.

Every message create / update / delete writes an entry to message_audit_log with the actor, channel, action, and payload.

Audit log reads are restricted to admins, quality approvers, inspectors, and channel members. Inspector-grade export bundles are produced as hash-stamped packages (metadata, participants, consent log, transcript, signatures).

External auditors can be granted scoped, time-bounded, read-only access via the auditor portal. Every page view is logged with IP hash and user agent.

Meeting transcription is disabled by default and only activates after every participant grants explicit, individual, timestamped consent. If any participant declines, transcription cannot start for that session.

Consent events are stored in an append-only meeting_consent_events ledger.

DAIN features (summaries, Decision DNA, Perspectives, Organizational Memory, knowledge extraction) are powered by Lovable AI Gateway. No customer data is used to train third-party models.

All DAIN requests are rate-limited per user (30/minute, 300/hour) to protect cost and prevent abuse.

System prompts and DAIN keys are held server-side; the browser never sees them.

Hosting runs on Cloudflare's global edge network. Backups are managed by the underlying database provider; restore drills are documented.

Runtime exceptions are captured by structured server logging tied to the originating request.

• Cloudflare — application hosting and edge compute.
• Supabase — managed database, authentication, and storage on AWS.
• Lovable AI Gateway (Google Gemini) — large language model inference for DAIN features.
• Klipy — GIF search (optional, configured per workspace).

Suspected vulnerabilities can be reported to security@mydain.ai. We aim to acknowledge within 2 business days.