Security at Lapse.watch

Lapse.watch runs on modern, battle-tested infrastructure designed for reliability and security at scale.

• →Vercel Edge Network — Automatic SSL/TLS, global CDN, and DDoS protection for all web traffic
• →Supabase PostgreSQL — Managed database with automated backups, point-in-time recovery, and row-level security (RLS)
• →Redis (Upstash) — Rate limiting and caching with enterprise-grade reliability

Your data is encrypted at every layer — in transit, at rest, and during processing.

• →TLS 1.3 — All data in transit uses modern, authenticated encryption
• →Encrypted at Rest — PostgreSQL databases use AES-256 encryption; backups are encrypted
• →No Credit Card Storage — Payment data never touches our servers; processed securely through Stripe
• →Daily Backups — Automated database backups with 7-day retention

Secure access controls with industry-standard password hashing and single sign-on support.

• →bcrypt Password Hashing — Passwords are never stored in plain text; industry-standard bcrypt with cost factor 10
• →Microsoft SSO — Enterprise single sign-on via Microsoft Entra ID / Azure AD
• →Secure Sessions — HTTP-only cookies, automatic session expiry, secure session rotation

Granular permissions ensure users only access data they're authorized to see.

• →Row-Level Security (RLS) — Database policies enforce that users only see their own data
• →Team-Based Permissions — Role-based access control within organizations
• →Scoped API Keys — API access keys are team-specific and can be revoked instantly

We follow security best practices and are working toward formal certifications.

• →SOC 2 Type II — Planned certification for 2026
• →OWASP Best Practices — Regular security audits and dependency updates
• →Automated Security Scanning — Dependabot and Snyk for vulnerability detection

Found a vulnerability? We take all security reports seriously.

Email us at security@lapse.watch with details of the issue. We'll respond within 48 hours and work with you to resolve it promptly.

We follow responsible disclosure practices and are happy to credit security researchers who help us improve our security posture.