Security at Disqovr

Disqovr uses Supabase Auth for user authentication, with bcrypt password hashing and email verification. Multi-factor authentication (TOTP) is available to every user: enrolment is self-serve from account settings (scan a QR code or enter the secret manually), and once a verified factor exists, the platform enforces a step-up MFA challenge on every session before any authenticated area can be reached.

Access within the platform is governed by role-based access control. Workspace members hold admin or member roles; sensitive operations (billing, data export, audit log access, workspace settings) require the admin role. Project-level membership further scopes who can see and act on each evaluation.

External vendor and stakeholder portals do not use shared magic links. Access is authenticated with single-use, expiring one-time codes sent to the invited email address: each code expires after 10 minutes, is invalidated on use, and issuing a new code invalidates outstanding ones. A successful code exchange establishes a scoped portal session limited to that project and audience.

SAML single sign-on is available for Enterprise workspaces. Workspace admins request a connection for their email domain in-app; we register the customer's identity provider (Okta, Microsoft Entra ID, Google Workspace, or any SAML 2.0 IdP) and activate the connection. One email domain routes to exactly one workspace, and MFA enforcement applies independently of SSO. SCIM provisioning is not yet available.

Disqovr runs on Supabase (managed PostgreSQL, authentication, and file storage) and Vercel (application hosting). Data is encrypted in transit with TLS and at rest with AES-256 on Supabase's managed infrastructure. Database backups are managed by Supabase; our hosting region and backup configuration details are available to customers on request.

The platform includes a maintenance mode: a platform-wide switch that blocks all write operations while leaving data readable, used for safe migrations and incident containment.

Application errors are captured by Sentry for monitoring and alerting, with noisy control-flow filtered out so genuine faults surface quickly.

Every record in Disqovr is scoped to a workspace (tenant). Tenant scoping is enforced in the data access layer on every query, and row-level security policies are enabled on tenant-scoped tables at the database layer.

We don't just assert this. We test it. A dedicated cross-tenant isolation audit runs in our CI pipeline: it connects to the database both as the application role and as an anonymous client, verifies that RLS is enabled on every tenant-scoped table, and checks that tenant data cannot be read across workspace boundaries. The build fails if any check fails.

Each workspace has an append-only audit log recording who did what and when (project changes, membership changes, scoring actions, and other material events), viewable by workspace admins in Settings → Audit log.

Workspace admins can run a one-click data export at any time (Settings → Workspace), producing a JSON export of the workspace's material data. No support ticket, no waiting. It answers the "can we get our data out?" question directly. "At any time" includes after your subscription ends: a lapsed workspace goes read-only rather than locked, and the export stays available for the full 12-month retention window.

AI features (evaluation insights, requirement drafting) are processed via the Anthropic API. Customer content sent to the API is not used to train models. AI access is governed by a central gate checked on every AI call: a global kill switch can disable AI platform-wide, trial workspaces are excluded by default, and the gate fails closed: if the check cannot complete, no AI call is made. When AI is off, the product degrades gracefully; evaluations work without it.

AI is included on Pro, Business and Enterprise (Starter and trials excluded). Every AI output is a draft you review and edit before anything is saved. Nothing is auto-decided. See what's included in each plan →

Every response carries strict security headers: a Content-Security-Policy, Strict-Transport-Security (HSTS with preload), X-Frame-Options DENY, X-Content-Type-Options, Referrer-Policy, and a restrictive Permissions-Policy.

Every push and pull request runs through a CI pipeline gating on type checks, unit tests, linting, the cross-tenant isolation audit, a production build, and an end-to-end flow check. Dependency vulnerability scanning runs via Dependabot: scheduled update PRs weekly, with security updates raised immediately.

All database access goes through Drizzle ORM with parameterised queries, removing SQL injection exposure. Public forms are protected against bots with Cloudflare Turnstile. Service accounts and API keys follow least privilege.

We welcome responsible disclosure of security vulnerabilities. If you believe you have found a security issue in Disqovr, please email security@disqovr.com with a description of the issue and steps to reproduce it.

We commit to acknowledging your report within 48 hours, providing an initial assessment within 5 business days, and keeping you informed of our progress towards resolution. We follow coordinated disclosure principles and ask that you give us a reasonable opportunity to address the issue before public disclosure. We do not currently operate a bug bounty programme, but we recognise significant contributions in our security acknowledgements.