Security
Security and data protection.
How your data is stored, who can see it, and what we do to keep it that way. Plainly stated, including what we don’t offer yet.
On this page
Infrastructure
Squario’s database and file storage run on Supabase, on Amazon Web Services. The web app is served by Vercel. Transactional emails are sent through Resend. The full list of providers is in the privacy policy.
Isolation per workspace
Every table is protected by Postgres row-level security. Every query is scoped to your workspace, and privileged functions re-check membership.
Roles and field-level permissions
Roles bundle permissions per action. Field-level read and write restrictions are enforced on the server, everywhere, including in Squaria and over MCP.
Sign-in
Two-factor authentication with an authenticator app, email one-time codes, and Cloudflare Turnstile bot protection on sign-in and public forms.
Activity log
An audit trail of changes in the workspace, available to roles with access to it.
Privacy and GDPR
Erase a person’s data (pseudonymisation), export everything about a person (portability), delete your own account, or delete a whole workspace with its stored files.
AI and MCP
Squaria and MCP clients act as the signed-in user, with the same permissions. Squaria asks for confirmation before it creates, updates, archives or moves records. It can see file names in Drive but never reads file contents. MCP clients connect over OAuth 2.1. Squaria’s requests are processed by OpenAI, called from Squario’s servers.
Web security
A strict Content Security Policy without inline scripts, HSTS preload, framing blocked, signature-checked webhooks from our providers, and share-link tokens stored as hashes.
Secrets
The credentials vault encrypts entries with pgcrypto, with the key held in Supabase Vault, and decrypts them only through permission-checked functions.
Payments
Stripe processes all payments. Squario never sees card numbers.
Consent-first analytics
Product analytics (PostHog, EU cloud) and affiliate tracking load only after you consent. In the app, session replays mask all text and inputs.
Report a vulnerability
Email hello@squar.io with “Security” in the subject. Also listed in /.well-known/security.txt.
What we don’t offer yet. We’d rather tell you now than in procurement.
- Single sign-on (SSO/SAML)
- SOC 2 or ISO 27001 certification
- A public status page
- A contractual uptime SLA
If one of these is a requirement for you, tell us at hello@squar.io.
Questions from your security team?
Send them over. We’ll answer in writing.
Free for one member · No card needed