Security — NanoCB

Workspace isolation

Every record is scoped to a workspace and enforced in the database, not just in the UI.

PostgreSQL row-level security on all business tables
Single-tenant admin scoping: an admin can only see their own workspace
Company-level scoping inside a workspace

Document-level visibility

Seeing an order does not mean seeing every price on it.

A company sees a document only if it issued it, holds it, or is its counterparty
Factory prices on purchase contracts stay with the exporter
Downstream store companies never see upstream purchase invoices

Files & evidence

Private object storage — no public URLs
Downloads via short-lived signed URLs (10 minutes)
SHA-256 recorded for every generated document
Issued documents are immutable; re-issuing creates a new record

Audit trail

Every issue / sign / receive / upload is logged with actor, time and before/after state
Template changes are versioned
Imports are transactional — a failed chain leaves no partial documents

Accounts & access

Email + password with hashed credentials (managed by Supabase Auth)
Role split: platform, workspace admin, company user
No shared logins — one account per company
Session cookies are HTTP-only and refreshed server-side

Data ownership

Your data stays yours — full JSON export on demand
Workspace closure keeps data readable for 30 days, then permanent deletion
Deletion removes business data, files and login accounts

Infrastructure

Layer	Provider	Location	Notes
Application	Vercel	Global edge + regional functions	TLS everywhere, HSTS-ready
Database	Supabase (PostgreSQL 17)	AWS Asia Pacific (Seoul)	Row-level security, encrypted at rest
File storage	Supabase Storage	AWS Asia Pacific (Seoul)	Private buckets, signed access only
Email	Hostinger	EU	Support mailboxes only, no customer data

What we do in production

Least-privilege service keys — server-side only, never shipped to the browser
Requests are authorised twice: at the API layer and again by database policies
Signed URLs expire in 10 minutes and are generated per request
Plan limits and subscription state are enforced server-side before writes
Routine backups by the database provider; export available at any time

What we do not claim

NanoCB does not verify the factual accuracy of the data you upload
NanoCB is not a substitute for your accountant, customs broker or tax authority filing
We are not yet SOC 2 / ISO 27001 certified — ask us for the current status before procurement

Security questions, pen-test reports or a data processing agreement: hello@nanocb.com. Report a vulnerability to the same address; we acknowledge within two business days.