Security

Security is not an afterthought at Stelo | it is part of the architecture from day one. This page describes the measures we take to protect your data and the accounts you trust us with.

Data Storage

All user data is stored on infrastructure operated by Supabase, Inc. Supabase is SOC 2 Type II certified and maintains industry-standard security controls. Data is hosted in data centres that comply with ISO 27001.

Stelo does not manage passwords at all. Sign-in uses a one-time code sent to your email address, or Sign in with Apple or Google, handled by Supabase Auth. Because there is no password for your Stelo account, there is no password for us to store, leak, or for anyone to reuse from another breached site.

---

Application Security

Authentication

Sessions are managed with short-lived JWT access tokens and a refresh token, issued by Supabase Auth. Signing out invalidates the session on that device. Per-device session revocation from Settings, and two-factor authentication, are planned but not available yet.

Input validation

All data submitted to the Stelo API is validated and sanitised server-side to prevent injection attacks. We follow the OWASP Top 10 guidelines in our development practices.

Rate limiting

Authentication endpoints are rate-limited by Supabase Auth, which throttles repeated requests for one-time codes from the same address. Scheduled server-side jobs require a shared secret header in addition to a valid token.

Dependency management

Third-party dependencies are audited for known vulnerabilities with automated tooling. We aim to apply critical security patches promptly, and we would rather state that plainly than promise a fixed deadline a small team cannot guarantee.

---

Payment Security

Stelo+ subscriptions are handled entirely by RevenueCat (subscription management) and Stripe (payment processing). Stripe is certified to PCI Service Provider Level 1 | the most stringent level of payment card industry certification.

Stelo never receives, processes, or stores raw payment card data. We only receive a subscription status (active/inactive) and renewal dates from RevenueCat.

---

Social Feature Privacy

Friend connections in Stelo are mutual and require both parties to confirm. By default, only your username, current streak, and level are visible to friends. You can further restrict what is shared in Settings. We never expose your email address or other account details to other users.

---

Breach Response

In the event of a confirmed security breach affecting user data, we will:

• Notify affected users within 72 hours of becoming aware of the breach, consistent with GDPR Article 33 and UAE data protection obligations.
• Provide a clear description of what data was affected, the likely consequences, and the measures we have taken or will take.
• Cooperate fully with relevant supervisory authorities.

---

Responsible Disclosure

If you have discovered a security vulnerability in Stelo, we want to know about it as soon as possible. We ask that you:

• Report the vulnerability to us via email before disclosing it publicly.
• Provide sufficient detail for us to reproduce the issue.
• Give us reasonable time to address the vulnerability before disclosure | we aim to acknowledge within 48 hours and resolve critical issues within 14 days.
• Not access, modify, or delete other users' data during testing.

We do not take legal action against good-faith security researchers who follow these guidelines.