Security Overview
Last updated: October 1, 2026
Our Commitment
QuietRiver is built to handle your personal focus, time, and reflection data safely. This page gives a plain-language summary of how we protect that data.
Infrastructure
| Component | Provider | Notes |
|---|---|---|
| Application hosting | Vercel | Application servers in Montréal, Canada; global CDN and DDoS protection at the edge |
| Database and authentication | Supabase | Managed PostgreSQL with row-level security |
| Payment processing | Stripe | PCI-DSS Level 1 certified |
| Transactional email | Brevo |
Data in Transit
All communication between your browser and QuietRiver is encrypted using TLS (HTTPS). We do not serve any content over plain HTTP.
Data at Rest
Your data is stored in Supabase (managed PostgreSQL). Supabase encrypts data at rest using AES-256.
Authentication
Authentication is handled by Supabase Auth:
- Passwords are hashed and never stored in plain text
- Session tokens are short-lived and rotated
- Password reset links are single-use and time-limited
Access Controls
Row-Level Security (RLS) is enforced at the database level. Every query is scoped to the authenticated user’s account. Users can only access their own data; it is not possible to read another user’s tasks, focus data, diary entries, or account information through the application.
Payment Security
QuietRiver does not store payment card numbers, CVV codes, or full billing addresses. All payment data is processed and stored directly by Stripe, which is PCI-DSS Level 1 certified. QuietRiver stores only a Stripe customer reference and subscription status.
Error Monitoring and Logs
No third-party error monitoring service is in use. Application logs are retained for a limited period and are accessible only to the engineering team.
We take care to avoid logging sensitive user content (such as notes or task names) in error logs or monitoring systems.
Backup and Recovery
Database backups are managed by Supabase: automated daily backups with a 7-day retention window.
In the event of data loss, we will make reasonable efforts to restore from the most recent backup. We cannot guarantee zero data loss in all failure scenarios.
Responsible Disclosure
If you discover a security vulnerability in QuietRiver, please report it to:
Please do not publicly disclose vulnerabilities before we have had a reasonable opportunity to investigate and respond. We aim to acknowledge reports within 2 business days.
Security Updates
We monitor our dependencies for known vulnerabilities and apply security patches promptly.
What We Do Not Do
- We do not monitor your websites, apps, keystrokes, or computer activity
- We do not access your data except as required to provide support you have requested
- We do not sell or share your personal data with advertisers