Security Policy

Security program

noburn implements technical and organizational measures aligned with SOC 2 trust principles. We are not yet SOC 2 Type II certified.

Technical controls

Our application implements:

• Authentication via Clerk with organization-scoped access
• Row-level security on Supabase for tenant isolation
• SHA-256 hashing for SDK keys; webhook secrets hashed at rest
• HMAC verification for inbound Stripe and outbound webhooks
• Rate limiting, security headers (CSP, HSTS), and structured audit logging
• HTTPS everywhere; secrets stored in environment variables only
• Analytics data sent to PostHog (US); session recording at 10% sampling; no PII in event payloads
• Transactional email via Resend; email addresses processed only for delivery, not retained by noburn

Reporting vulnerabilities

Report security issues to hello@robatdasorvi.com. We aim to acknowledge reports within 2 business days.

Please do not publicly disclose vulnerabilities before we have had a reasonable time to remediate.