Security and privacy

Where the data lives

The database and files are in São Paulo, on Supabase. The server functions run in São Paulo, on Vercel, and static pages pass through the global delivery network. The other services that touch any data are in the subprocessor list, with the country of each.

One company never sees another's data

• On every table, the database itself returns only the rows of the company asking (row-level security).
• On every request, the server checks in the database which company you belong to and what your role is. Claiming in the browser that you belong to another company opens nothing.
• Automated tests try to read, change, delete and insert one company's data using another company's account, and they must fail.

Encryption

All traffic uses HTTPS, with a 2-year HSTS policy so the browser never falls back to an open connection. The database provider encrypts data at rest. API keys and integration tokens get an extra layer of our own encryption (AES-256), with the key kept outside the database.

Access and roles

People sign in by an emailed link or code, or with a Google account. Inside a company there are five roles: owner, admin, manager, member and read-only. Read-only can only view, members import data and request connections, managers also approve fixes, admins manage the team and settings, the owner deletes the company. The role is checked on the server for every request. The demo also opens through the account: the sample companies appear only for accounts we enable. The demo with the viewer's own numbers also accepts an access password, and that screen writes nothing to our database. On the GrowRockets side, the internal screens that read company data open only for a closed list of team emails, with a confirmed email, checked on the server.

Other protections

What is switched on today:

• Each company sees only its own data: the database enforces access per company on every table (row-level security), and we test that one company cannot read, change or delete another one's data
• Encrypted connection (HTTPS) across the site, with a 2-year HSTS policy, and data encrypted at rest by the database provider
• API keys and integration tokens encrypted with AES-256 before they reach the database, with the key kept outside the database
• Access by an emailed link or code, or a Google account, with roles inside the company (owner, admin, manager, member and read-only) checked on the server for every request
• Content security policy (CSP) with a fresh code per page, headers against clickjacking and content sniffing, and protection against requests from other sites on actions that change data
• Request limits per person and per network, bot verification and a honeypot field on public forms
• Error reports without request body, cookies, email or code variables, removed before they leave the server
• Secrets only on the server: no secret key reaches the browser, and automated tests check that

Your rights

Inside Radar, under Settings, in the "Privacy and data" section, each person downloads their own data, corrects their name and deletes their account, without waiting for anyone to answer. Owners and admins also download company data. For anything else, or for a request from your company about its customers' data, write to the data protection officer. The revenue scan is deleted on its own after the period above; deleting the account also deletes the scans made with it or with the same email.

Rony Lussari: privacidade@growrockets.com (rony@growrockets.com)

If something goes wrong

If an incident affects personal data, we tell the customer company without undue delay. When we are the controller, we notify Brazil's data protection authority (ANPD) and the people affected within the period the law sets. The notice says what happened, which data, what we have done and what the company can do.

Certifications and testing

We do not hold SOC 2 or ISO 27001 certification and we claim none. Our controls follow the same line as those standards, and we can answer your security team's questionnaire. We have no independent penetration test report to share today.

Found a flaw?

Write to privacidade@growrockets.com. Please do not run tests that affect other people or access data that is not yours. We reply within 3 business days and take no action against anyone who reports in good faith. The address is also in /.well-known/security.txt.