Security
Sign-in and sessions
You sign in with Google (OAuth). Promythia never sees or stores a password. Your session is held in a secure, HTTP-only cookie rather than in browser storage, and is verified on the server on every request to protected pages.
Your data is isolated to your account
Every table that stores your information enforces PostgreSQL Row-Level Security, scoped to your authenticated user ID. This means the database itself — not just application code — prevents any account from reading or writing another account's data. Row-Level Security is enabled and enforced on every such table (it applies even to the database's own owner role, not only to application queries), and each cap table record additionally verifies it belongs to your company before any change is allowed.
Encryption and hardening
All traffic is served over HTTPS/TLS, with HTTP Strict Transport Security enabled. Your data is encrypted at rest by our database infrastructure. Every response also carries a strict Content-Security-Policy and hardening headers — clickjacking protection, MIME-sniffing protection, and restrictive referrer and permissions policies.
Where your data lives
Your cap table data is stored in a Canadian region (our database runs in Supabase's Canada Central region). The application is delivered through Vercel, and some request processing may take place in the United States. Our Privacy Policy describes this cross-border processing in more detail.
Least privilege
The key the app uses in your browser is a public, restricted key that can do nothing without a valid signed-in session and is bounded by Row-Level Security. Administrative database credentials are never exposed to the browser.
Administrative access
Administrative actions are limited to authorized roles held in a trusted, server-verified claim that users cannot edit. Privileged operations — and any staff access to account data for support or operations — are recorded in an append-only audit log.
Abuse protection
Sensitive endpoints, including the contact form and cap table import, are rate-limited to deter automated abuse.
Your data isn't indexed
Our public marketing pages are open to search engines, but the application itself — your working session and its contents, including your cap table data — is deliberately excluded from search engines and AI crawlers (through a noindex response header and robots rules), so it is never surfaced in public search results.
Built on trusted infrastructure
Promythia is built on Google (authentication), Supabase (database and authentication), Vercel (hosting and delivery), and Stripe (payment processing), each of which maintains its own security program. Card details are handled directly by Stripe, a PCI-DSS Level 1 certified provider, and never touch our servers — we store only limited billing metadata such as the card brand and last four digits.
Your part
• Keep your Google account secure and don't share access to it.
• Be cautious when signing in on a public or shared device, and sign out when you're done.
• Tell us right away if you notice anything suspicious about your account.
Reporting a security concern
If you believe you've found a security vulnerability, please email security@promythia.com. We appreciate responsible disclosure and will work with you to address genuine issues.
No online service can guarantee absolute security. We take reasonable measures to protect your information and continue to strengthen them over time.