Security Policy

1. Infrastructure Security

• DNS infrastructure: Operated via Gcore's authoritative Anycast DNS network spanning 180+ global edge locations, providing inherent DDoS resilience.
• Database: Supabase PostgreSQL with Row-Level Security (RLS) policies enforced on every table — no user can access another user's data via direct API calls.
• Authentication: OAuth 2.0 via GitHub and Google. No passwords are stored by LovieMe. Session tokens use short-lived JWTs with refresh rotation.
• Hosting: Platform served via Vercel Edge Network with automatic HTTPS, HSTS preloading, and zero-downtime deployments.
• Secrets management: All API keys, service tokens, and credentials are stored as encrypted environment variables — never hardcoded in source code.

2. Data Encryption

• In transit: TLS 1.2+ enforced on all connections. HTTP requests are automatically redirected to HTTPS. HSTS header is set with a minimum max-age of one year.
• At rest: Supabase encrypts data at rest using AES-256. Gcore encrypts DNS zone data at rest per their infrastructure standards.
• Email routing: SMTP email forwarding rules are stored encrypted. Email bodies are never stored by LovieMe — only alias routing rules.

3. Access Controls

• Internal access to production systems is restricted to authorised personnel only (Sagar Kewat as the sole operator).
• Supabase RLS policies ensure every database query is scoped to the authenticated user's identity.
• Gcore API keys are scoped with the minimum permissions required for DNS zone management.
• No third-party contractors have access to user data or production infrastructure.

4. Monitoring and Incident Response

LovieMe employs the following monitoring practices:

• Real-time error monitoring via Vercel deployment logs and Supabase audit logs.
• Automated alerts for anomalous authentication patterns (managed by Supabase Auth).
• Gcore edge analytics and health checks for DNS traffic monitoring.

In the event of a confirmed security incident affecting user data, we will notify affected users within 72 hours via their registered email address and post a public status update. We will also notify the relevant Data Protection Authority where required by law.

5. Responsible Disclosure Policy

We welcome and encourage security researchers to responsibly disclose vulnerabilities. If you discover a security issue in LovieMe:

• Email your findings to legal@lovie.me with a clear description of the vulnerability, steps to reproduce, and potential impact.
• Please allow us a minimum of 14 days to investigate and remediate before public disclosure.
• Do not attempt to access or modify other users' data, disrupt platform operations, or perform automated vulnerability scanning against production systems.
• We will acknowledge all valid reports and credit researchers in our security changelog (with permission).

We currently do not operate a formal bug bounty program, but we appreciate every responsible disclosure.

6. User Security Responsibilities

You are responsible for:

• Securing your GitHub or Google OAuth account with a strong password and two-factor authentication (2FA).
• Logging out of LovieMe on shared or public devices.
• Not sharing your session tokens or dashboard access.
• Promptly reporting any suspicious activity on your account to legal@lovie.me.

7. Third-Party Security

LovieMe relies on Supabase, Gcore, and Vercel as core infrastructure providers. Each maintains industry-leading security certifications:

• Gcore: ISO 27001, PCI DSS, SOC compliance.
• Supabase: SOC 2 Type II (in progress), data encrypted at rest and in transit.
• Vercel: SOC 2 Type II, ISO 27001.

8. Contact