Security Statement

Your organization is storing its performance record, its team’s development history, and honest notes about real people in The Same Page. Here’s exactly how we protect it.

The short version: your organization’s data is isolated at the database level, encrypted in transit and at rest, never used to train AI models, and never sold to anyone.

Data Storage

All data is stored in a PostgreSQL database hosted by Supabase on Amazon Web Services in the United States (us-east-1, Northern Virginia). Files you attach are kept in Supabase Storage in the same region, in a folder scoped to your organization.

Encryption in Transit

All communication between your browser and The Same Page, for both the web app and the backend API, is encrypted using HTTPS/TLS. Unencrypted HTTP connections are not accepted.

Encryption at Rest

Data at rest is encrypted by our infrastructure provider (Supabase on AWS). The Same Page does not store passwords, OAuth tokens, or user-supplied API keys.

Per-Organization Data Isolation

The Same Page uses Row-Level Security (RLS) enforced at the database layer. Every query against your data passes a database-level policy check, so your organization’s data is isolated from every other organization’s regardless of application logic, and what an individual account can see within your organization is scoped the same way. This is a database-enforced constraint, not just a software guard.

Authentication

Sign-in is handled by Supabase Auth using single-use links sent to your email address. Every authenticated API request has its token verified on the server; tokens are never trusted on the client alone.

AI Providers

When you use an AI feature, the content that feature needs is sent to our AI provider (Anthropic, or OpenAI as a backup and for voice transcription) at that moment, under commercial terms that do not permit the provider to train on it. We do not use your content to train AI models, and nothing an AI drafts is saved until a person reviews and confirms it.

Usage Measurement and Error Monitoring

We measure product usage with PostHog and monitor errors with Sentry. Both are configured so that what you type never leaves as part of them: usage events are page views and counts, IP addresses are discarded, session recording is off, and request credentials are filtered from error reports. There are no advertising SDKs or ad pixels in the app.

Account Export and Deletion

You can download everything your account holds, or permanently delete your account, from Settings at any time. Deletion removes your records from our database and file storage, and your contact and usage records from our email and analytics providers. It cannot be undone.

Rate Limiting

API endpoints are rate-limited to protect against abuse and runaway automation.

What We Don’t Do

• We do not sell or share data with recruiters, advertisers, or data brokers
• We do not use your organization’s content to train AI models
• We do not store payment card numbers; when billing is introduced, it will be handled by a PCI-compliant payment processor

Responsible Disclosure

If you discover a security vulnerability in The Same Page, please report it to ag@thesamepage.xyz before disclosing it publicly. We will investigate and respond promptly.

Questions

For security-related questions, contact us at ag@thesamepage.xyz.