The defenses.

Security is a design constraint at Ceezaer, not an afterthought. This page describes the controls protecting customer data in plain language, the way we would answer an enterprise vendor review.

Encryption in transit

All connections to ceezaer.com and the platform are served exclusively over HTTPS with TLS 1.2+. HTTP requests are redirected to HTTPS, and HSTS instructs browsers to refuse insecure connections.

Encryption at rest

Customer content — database records and uploaded files — is stored on infrastructure that encrypts all data at rest (AES-256). Encrypted backups are maintained by our database provider on an automatic schedule.

Authentication and passwords

• Authentication is handled by Supabase Auth. Passwords are stored only as salted bcrypt hashes — never in plain text, and never visible to Ceezaer.
• Email verification is required before account access; password resets use single-use, time-limited links.
• Sessions use short-lived JSON Web Tokens with automatic refresh and server-side revocation on sign-out and password change.

Access controls

• Every database table enforces row-level security: a customer's session can only ever read or write that customer's own rows. Isolation is enforced by the database itself, not just application code.
• Uploaded files live in per-user storage folders governed by the same policies; sharing happens only through links you explicitly create, and share links can be revoked.
• Administrative access is limited to designated Ceezaer personnel, protected by separate credentials, and used only for support and operations.

Payments

All payment card data is handled by Stripe, a PCI-DSS Level 1 certified processor. Card numbers never reach Ceezaer servers. Webhooks from Stripe are verified with cryptographic signatures.

Infrastructure

The platform runs on established cloud providers — Netlify (hosting and serverless functions) and Supabase (database, auth, storage) — inheriting their physical security, network isolation, and compliance programs. There are no self-managed servers to patch.

Audit logging and monitoring

Authentication events, administrative actions, and billing changes are logged. Function logs are retained for operational monitoring and incident investigation.

Backups and availability

Databases are backed up automatically every day with point-in-time recovery available from the provider. Static site content is versioned, and every deploy is immutable and instantly revertible.

Incident response

If we become aware of a security incident affecting customer data, we will investigate immediately, contain it, and notify affected customers without undue delay — within 72 hours of confirmation — with what happened, what data was involved, and what we are doing about it.

Responsible disclosure

We welcome good-faith security research. If you believe you have found a vulnerability, email info@ceezaer.com with the subject line “Security”. Please give us reasonable time to remediate before public disclosure; do not access data that is not yours or degrade the service while testing. We will acknowledge reports within 3 business days and credit researchers who wish to be named.

Questions

Enterprise customers evaluating Ceezaer can request additional detail — architecture walkthroughs, subprocessor terms, or completed security questionnaires — at info@ceezaer.com.