Security

Last updated: 2026-08-04

This page describes the technical and organizational measures currently in place to protect your data. It is intentionally factual: it lists only what is actually deployed.

Hosting & data location

The application is hosted on Vercel, with serverless functions running in Paris (cdg1). The PostgreSQL database is hosted by Supabase in the eu-west-3 region (Paris, France). Uploaded files (logos, exports, imports) are stored on Amazon S3 in the EU (eu-north-1, Stockholm).

Encryption

All traffic is encrypted in transit with TLS. Data is encrypted at rest by Supabase and Amazon S3. OAuth access tokens for integrations are additionally being migrated to application-level encryption (AES-256-GCM) so they remain unreadable even with database access.

Credentials & abuse prevention

Passwords are hashed with bcrypt (12 rounds) and never stored in plain text. Sensitive endpoints are rate-limited to slow down brute force and abuse.

Access control

Access to data is scoped per workspace with role-based access control (RBAC). Members only see the workspaces they belong to, with permissions matching their role.

Backups

The database is backed up automatically by Supabase, allowing restoration in case of incident.

Browser protections

The application ships strict HTTP security headers, including a Content-Security-Policy (CSP) and Strict-Transport-Security (HSTS), to mitigate XSS and protocol-downgrade attacks.

Analytics & IP addresses

For QR scan events, IP addresses are truncated and hashed (with a salt) before storage — we never store raw scan IP addresses.

See also: our list of subprocessors.

Contact

Email: support@qr-queen.io