Security

Hosting and data location

Guest and event data is stored in a Supabase Postgres database in the EU (eu-west-1), alongside file storage in the same project. Application compute runs on Vercel. TODO: compute region pinning is not currently configured — until it is, we do not claim EU-only processing.

Encryption

Passport numbers and medical notes are encrypted at the field level (AES-GCM) with a key held outside the database, on top of the provider's at-rest disk encryption. All traffic is TLS.

Data isolation

Every organization's data is scoped by membership-based access checks, and a cross-tenant isolation suite runs against the codebase: two seeded organizations, substitution of each other's identifiers across routes, with positive controls proving the checks execute.

Access controls

Role-based access with five workspace roles. Client viewers are scoped to a single event and never see medical, passport or allergen detail — enforced in the queries, not the templates. Property partners use expiring tokenised links scoped to one property's list, and hold no account at all. Sign-up is invitation-gated.

Sensitive-data deletion

Closing an event permanently destroys passport identity, medical notes, dietary and accessibility data, uploaded scans and generated visa PDFs, and revokes guest links — while preserving operational history. A 24-assertion harness verifies this on every change.

Audit logging

Sensitive actions — role grants, data exports, purges, visa decisions — are written to an append-only audit table with actor and timestamp.

Backups

TODO: document provider backup schedule and our tested restore procedure before claiming recovery objectives.

Incident response & breach notification

TODO: response process and notification commitments — counsel and operations to define; no commitment is published until it exists.

Availability & recovery objectives

TODO: no SLA is published yet. SLA display for paid plans arrives with plans.

Vulnerability reporting

Found something? Email hello@growwithguava.com with steps to reproduce. TODO: formal disclosure policy.

Data processing agreement

TODO: DPA template slot — counsel to supply; will be linked here.

Retention schedule & data export

TODO: retention windows and the export process document — to be defined with the account lifecycle work.