1. Access control

Every request is authorized by role on the server, and the database enforces row-level security so users can only reach data they are permitted to see. Clients are isolated from one another; editors see only projects assigned to them.

2. Authentication

Sign-in uses one-time email links rather than passwords, reducing the risk of credential theft. Disabled or offboarded accounts are blocked from establishing a session.

3. Data protection

Data is transmitted over encrypted connections. Sensitive fields (such as payout details) are encrypted at rest. Security headers and rate limiting protect against common web attacks.

4. Monitoring and response

Significant actions are audit-logged. If we become aware of a security incident affecting your personal data, we will act to contain it and notify affected users and authorities as required by law.

5. Reporting a vulnerability

If you believe you have found a security issue, please report it responsibly to hello@gaurifyhq.com and do not attempt to access or alter data that is not yours.