Security

Enterprise-grade security is not an afterthought — it is built into every layer of WHITE LIFE AI, from the database to the edge network.

Data Protection

Strict tenant isolation with row-level security (RLS) policies on every table
Hash-chain audit trail for tamper-proof operation logging
Data residency controls — choose where your data is stored
Automatic data backup with point-in-time recovery
Full data export and deletion available on request (GDPR Article 17)

Encryption

AES-256 encryption at rest for all stored data
TLS 1.3 encryption in transit for every API call and data transfer
HMAC-SHA256 authenticated API gateway — every request is cryptographically verified
Secrets managed via Cloudflare Workers Secrets (never in code or environment files)
API keys are hashed before storage and rotatable at any time

Authentication

OAuth 2.0 with Google SSO for secure, passwordless login
Session management with Supabase Auth and HTTP-only secure cookies
Role-based access control (RBAC) for admin, member, and viewer roles
Automatic session expiry and refresh token rotation
Brute-force protection with progressive rate limiting

Infrastructure

Deployed on Cloudflare Workers — 300+ edge locations worldwide
Cloudflare DDoS protection with automatic mitigation at the network edge
Web Application Firewall (WAF) rules to block common attack patterns
Rate limiting per tenant, per endpoint, and per IP address
Zero-trust architecture — no VPNs, no exposed ports, no attack surface

Compliance

SOC 2 Type II certification in progress — expected completion Q3 2026
GDPR compliant — data processing agreements, right to erasure, data portability
Privacy-by-design architecture with minimal data collection
Regular third-party security audits and penetration testing
Responsible AI disclosure — full transparency on model provider data handling

Report a Vulnerability

We take security seriously. If you discover a vulnerability, please report it responsibly. We will investigate promptly and keep you informed throughout the process.

[email protected]

Have security questions? Contact our team or review our Privacy Policy.

Data Protection

Strict tenant isolation with row-level security (RLS) policies on every table

Hash-chain audit trail for tamper-proof operation logging

Data residency controls — choose where your data is stored

Automatic data backup with point-in-time recovery

Full data export and deletion available on request (GDPR Article 17)

Encryption

AES-256 encryption at rest for all stored data

TLS 1.3 encryption in transit for every API call and data transfer

HMAC-SHA256 authenticated API gateway — every request is cryptographically verified

Secrets managed via Cloudflare Workers Secrets (never in code or environment files)

API keys are hashed before storage and rotatable at any time

Infrastructure

Deployed on Cloudflare Workers — 300+ edge locations worldwide

Cloudflare DDoS protection with automatic mitigation at the network edge

Web Application Firewall (WAF) rules to block common attack patterns

Rate limiting per tenant, per endpoint, and per IP address

Zero-trust architecture — no VPNs, no exposed ports, no attack surface

Compliance

SOC 2 Type II certification in progress — expected completion Q3 2026

GDPR compliant — data processing agreements, right to erasure, data portability

Privacy-by-design architecture with minimal data collection

Regular third-party security audits and penetration testing

Responsible AI disclosure — full transparency on model provider data handling