SecurityUpdated 2026-05-13

How is data encrypted?

AES-256 at rest, TLS 1.3 in transit, application-level encryption for CNICs and any sensitive PII fields.

At rest: AES-256, managed by Supabase and the underlying cloud provider.

In transit: TLS 1.3 minimum. Older TLS versions are rejected at the edge.

Application-level: CNICs, NTNs, and other regulated PII fields are encrypted using a per-tenant key managed in Supabase Vault. Keys are rotated annually.

Field-level decryption is logged and rate-limited. Bulk decryption is not exposed to any admin role.

Where is our data stored?Primary data lives in Supabase Tokyo (ap-northeast-1). Pakistan residency option available for buyers that require it under PDPA-2023.
How is access controlled?Role-based access, row-level security on every tenant table, audit trail on every privileged action. Optional SSO with SAML 2.0.
Backups, RPO, and RTOContinuous WAL backups with point-in-time recovery to any second in the last 7 days. RPO 1 minute, RTO 4 hours.
Who are your sub-processors?Supabase, Cloudflare, Resend, Twilio, Mux, OpenAI/Anthropic for AI agents. Current list maintained at /aizaadi/help/sub-processors.

How is data encrypted?

Related articles

Still have questions?