This page is maintained by the MyCases service operator to answer common product, privacy, and security questions. It is app-owned content, not an independent certification. For legally binding terms, refer to the applicable order or service agreement.
This page lists controls that are currently implemented in the product, as well as items that are planned. We separate the two so you can make accurate decisions.
Currently Implemented
- Authentication: managed Supabase Auth with invite-only account creation for OAuth flows.
- Authorization: PostgreSQL Row-Level Security (RLS) on user data; owner / staff visibility model for cases, folders, beneficiaries, notifications, and billing.
- Privileged data isolation: notification delivery records are service-role only and never readable by end users. Recipient identifiers are stored in masked form.
- Payments: card data is processed and stored by Stripe. We store only Stripe identifiers and subscription state.
- Transport security: HTTPS/TLS in transit via the managed hosting platform.
- Scheduled jobs: internal cron endpoints require a rotated shared secret; secret rotation and re-registration are implemented.
- Idempotency: notification event fingerprints prevent duplicate delivery across concurrent manual/cron refreshes within a bounded window.
- Data export: cases can be exported as CSV from the workbench.
- Abuse controls on public endpoints: support contact submissions are rate limited atomically at the database level (SECURITY DEFINER RPC callable only by the server role); rate-limit keys are hashed with a server-side pepper so raw IPs are never stored.
Planned
- Full self-serve account-wide data export and deletion.
- Detailed audit log surfaces for team accounts.
- SSO / SAML for enterprise customers.
- Formal external attestations (e.g. SOC 2). We do not currently claim these.
Shared Responsibility
Managed platform capabilities are provided by the underlying hosting, database, and payments vendors. Application controls (RLS policies, entitlement checks, endpoint auth) are our responsibility. Your responsibility includes protecting your credentials, keeping invite links private, and configuring notification channels correctly.
Responsible Disclosure
If you believe you have found a security issue, please report it via /contact. Include steps to reproduce and any relevant scope. Please do not include real end-user credentials or sensitive personal data in your report.