How we protect data
Encryption
- All traffic to attrly.com and the platform uses HTTPS, with HTTP Strict Transport Security.
- Data is encrypted at rest by our hosting and database providers.
- Amazon access tokens are additionally encrypted with AES-GCM before they are stored, separately for each connected brand, and are never sent to the browser.
Separation between customers
- Every record belongs to one agency, and every query on the server is scoped to the signed-in user’s agency and brands.
- The database is reachable only from our servers. Row-level security is on and browsers get no direct database access.
- Roles limit each brand’s team to its own brand, and each creator to their own links and results.
Access and operations
- Sign-in runs on Supabase Auth, which never stores passwords in plain text.
- Production access is limited to the founding team.
- Secrets are kept in our hosting provider’s encrypted environment settings, not in code.
- Data is hosted in the United States.
- Browser security headers block framing, content sniffing and unneeded device permissions.
Amazon data
We request only the Amazon permissions Attrly needs, use Amazon data only to serve the agency and brand that connected it, and delete it as our privacy policy describes.
Certifications
Attrly is an early-stage product and does not yet hold SOC 2, ISO 27001 or similar certifications. We are happy to answer security questionnaires and walk customers through our setup.
If something goes wrong
If we learn of a security incident affecting customer data, we will:
- Act right away to contain it and protect affected data.
- Notify affected customers without undue delay, with what happened, what data was involved and what we are doing about it.
- Notify Amazon when Amazon data is involved, as Amazon’s policies require.
- Notify regulators or individuals where the law requires.
Reporting a vulnerability
If you believe you have found a security issue in Attrly, email security@attrly.com with the details and steps to reproduce. We will acknowledge your report, keep you updated, and will not take legal action against good-faith research that:
- Avoids accessing, changing or keeping other people’s data.
- Does not disrupt the service, including through denial-of-service or automated scanning at volume.
- Gives us reasonable time to fix the issue before sharing it publicly.
We do not run a paid bug bounty at this time.
Contact
Security: security@attrly.com. Everything else: hello@attrly.com.