P3AnalyticaSecurity
Last updated: June 7, 2026 · v1.0 · English (French coming — contact us for French)
We take the security of your data seriously. This page describes the protections in place today and how to report a security issue. It reflects our real architecture, not marketing claims.
Data protection
• Encryption in transit (TLS) for all traffic, and encryption at rest for stored data (provided by our database host, Supabase on AWS). • Per-organization data isolation enforced at the database layer with row-level security, so one customer’s data is not reachable by another. • Your data is hosted in the United States (AWS us-west-2, Oregon).
Access and authentication
• Password authentication with strength requirements, plus optional two-factor authentication (TOTP) — AAL2 — on accounts. • Least-privilege administration: the privileged admin console is restricted to the founder. There is no broad internal browsing of customer data. • Sessions and auth are handled by Supabase Auth.
Payments — what we do NOT store
We do not store card numbers or payment-instrument details. Payments are processed by Stripe, which holds the payment instrument. We store only Stripe identifiers and payment amounts in our records. Access to a paid plan is granted only on a signature-verified webhook event from Stripe — a forged “success” cannot grant access.
Infrastructure
The Service runs on Vercel (application hosting and edge compute) and Supabase (database, authentication, file storage). We rely on these providers’ platform security and keep our dependencies current. Public deploys go through an automated pipeline that includes a secret-scan and type checks.
Responsible disclosure
If you believe you have found a security vulnerability, please report it to pooria.sedd@p3analytica.com or via our security contact at /.well-known/security.txt. Give us a reasonable opportunity to investigate and remediate before any public disclosure. We appreciate good-faith research and will not pursue researchers who act responsibly and avoid privacy violations, data destruction, or service disruption.