Security at Arrexia

Arrexia is designed for businesses that store sensitive client, invoice, and payment information. We use industry-standard practices appropriate to our infrastructure and stage, including authenticated access, encrypted connections, and provider-level safeguards.

User accounts are managed through Supabase Auth. Passwords are handled using secure authentication flows rather than being stored in plain text by Arrexia application code.

Email verification

Email verification helps confirm account ownership and reduces the risk of unauthorized sign-ups or account takeover.

Data in Arrexia is organized by workspace. Users should only access workspaces they belong to, and product features are scoped to the active workspace context.

Row Level Security

Where applicable, Supabase Row Level Security (RLS) policies help ensure database queries can only return rows a signed-in user is permitted to access. This adds a database-layer check in addition to application logic.

Arrexia is served over HTTPS. Traffic between your browser and our application is encrypted in transit. Hosting and edge infrastructure on Vercel (and related CDN or protection layers such as Cloudflare where configured) help deliver the application securely and reliably.

API keys, database credentials, and other secrets are stored as environment variables rather than in source code. Access to production configuration is limited to authorized operators and deployment systems.

Invoice, reminder, and account emails are sent through Resend using configured sender identities. Email content is limited to what is needed for the specific transactional purpose.

Business data you enter — clients, invoices, payments, reminders, and notes — is stored in our database infrastructure and used only to provide the service. We do not sell your business data.

Database hosting through Supabase includes provider-managed infrastructure, monitoring, and backup capabilities. While no system is immune to failure, we rely on established cloud providers rather than self-managed servers.

If you believe you have found a security vulnerability, please report it responsibly to support@arrexia.app. Include enough detail for us to investigate. We appreciate good-faith reports and will work to address confirmed issues promptly.