Security

HyPurShot is built on hardened, audited infrastructure. We do not roll our own crypto, store raw payment cards, or rely on shared sending domains. Below is a plain-English breakdown of every system that touches your data.

Our principles

Least privilege
Every API key, OAuth token, and database role is scoped to the minimum permissions required. The key sending your review emails cannot read your account.
Defense in depth
Row-Level Security at the database, JWT validation at the edge, TLS in transit, and encryption at rest. A single failure does not expose data.
No raw secrets in code
API keys live in a secured config table accessible only to server-side functions, never shipped to the browser or committed to source.
Trust the standard
We delegate payments, SMS, and email to providers that are SOC 2, PCI DSS, or comparably audited — not in-house solutions.

Database — Supabase Row-Level Security

Supabase Postgres
SOC 2 Type II · HIPAA

Your business data, customer review requests, photos, and team membership all live in a Postgres database hosted by Supabase. We enforce Row-Level Security (RLS) policies at the database layer — meaning the database itself, not just our application code, rejects unauthorized reads.

What RLS guarantees:

  • A signed-in operator can only read and modify rows belonging to their own business
  • Team members see only the businesses they have been explicitly invited to
  • Public showcase pages serve only rows where the operator has set visibility = 'public' or shared a token
  • Even if our frontend code had a bug, the database would still refuse the query

Encryption: All data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Daily automated backups are retained for 7 days.

Audit: Supabase is SOC 2 Type II certified with regular third-party penetration testing.

Payments — Stripe PCI DSS Level 1

Stripe Checkout & Customer Portal
PCI DSS Level 1

HyPurShot never sees, touches, or stores your card number. When you subscribe, you are sent directly to Stripe Checkout — a payment page hosted by Stripe on a Stripe domain. Your card details go from your browser straight to Stripe's vault.

What we receive from Stripe:

  • A customer ID (e.g. cus_abc123) — an opaque token, not card data
  • A subscription status (active, past_due, canceled)
  • Your billing email and the price tier you selected

Compliance: Stripe is certified at PCI DSS Service Provider Level 1 — the highest level, audited annually, used by Amazon, Shopify, and millions of businesses. Because HyPurShot only handles tokens, the surface area for a card breach on our end is zero.

Webhook integrity: All Stripe webhooks reaching our backend are verified using HMAC-SHA256 with a webhook signing secret. Forged or replayed webhook events are rejected.

SMS — Twilio 10DLC Registration

Twilio Programmable Messaging
10DLC Verified · A2P Registered

Customer review request texts are sent through Twilio's 10DLC pipeline. 10DLC (10-digit long code) is the US carrier-approved framework for application-to-person SMS, replacing the old "shadow" SMS routes the major carriers now block.

What 10DLC registration means:

  • Our business identity and use case (transactional review requests) were vetted and approved by The Campaign Registry, the US wireless carrier consortium
  • Every text we send is delivered through a Trust Score–weighted route — carriers know who is sending and why
  • Carrier-mandated throughput and content limits are enforced at the network level
  • Spam-filter false positives drop dramatically vs. unregistered numbers

Customer-data handling: Customer phone numbers are transmitted to Twilio only for the moment of delivery. Twilio does not use them for advertising, profiling, or training. Standard opt-out keywords (STOP, UNSUBSCRIBE) are honored automatically.

Compliance: Twilio is SOC 2 Type II and ISO 27001 certified, with HIPAA-eligible products and GDPR DPA support.

Email — Resend with SPF, DKIM, and DMARC

Resend transactional email
SPF · DKIM · DMARC

Review request emails and account notifications are sent through Resend from a dedicated subdomain — send.hypurshot.com — that we control. We use all three modern email-authentication standards so receiving mail servers can cryptographically verify our messages.

SPF (Sender Policy Framework)

  • A DNS record tells the world: "Only Amazon SES / Resend infrastructure is authorized to send mail for send.hypurshot.com"
  • Any spoofed message claiming to be from our domain is flagged or rejected by Gmail, Outlook, Yahoo, and Apple Mail
  • Our record: v=spf1 include:amazonses.com ~all

DKIM (DomainKeys Identified Mail)

  • Every email we send is digitally signed with a 1024-bit RSA key
  • The matching public key is published in DNS so receivers can verify the signature
  • If a single byte of the message is tampered with in transit, the signature breaks and the message is rejected

DMARC (Domain-based Message Authentication, Reporting, and Conformance)

  • Our DMARC policy tells receivers what to do if a message fails SPF or DKIM
  • Aligned with industry best practices and ready for tightening to p=quarantine or p=reject as we accumulate sending reputation
  • Our record: v=DMARC1; p=none;

Why a dedicated subdomain: Sending only from send.hypurshot.com means our main hypurshot.com domain reputation is insulated. A compromised sending key cannot poison the main brand.

Compliance: Resend is SOC 2 Type II certified and GDPR-compliant.

Application security

Operational practices

Reporting a vulnerability

If you discover a security issue, please email us before public disclosure. We will respond within 48 hours and credit you in our acknowledgments if you wish.

Solidity Innovations LLC — HyPurShot Security

ronnie.purcell@gmail.com

Please include a clear description, reproduction steps, and your preferred contact method.

System status

For real-time uptime and incident history, see our Status page.