Security

Security is built into BreakWatch from the ground up, not bolted on. Here's how your data is protected.

Data isolation

Every team's data is isolated at the database level using row-level security, so one customer can never read another's sources, snapshots, or alerts — even if application code has a bug.

Encryption

All traffic is served over HTTPS/TLS. Your data is stored in a managed EU Postgres database (Supabase).

Payments

Card payments are handled entirely by Stripe, which is PCI-DSS Level 1 certified. BreakWatch never sees or stores your card details. Your plan status is only ever changed by a signature-verified Stripe webhook — never trusted from the browser.

Access & secrets

Privileged database keys are used only server-side and are never exposed to the browser. Authentication runs through Supabase Auth. Sign-up is protected with disposable-email filtering and rate limiting.

Untrusted input

Pages we fetch to monitor are treated as untrusted: fetched content is size-capped, sanitized, and never executed, and our change classifier cannot take actions.

Responsible disclosure

Found a vulnerability? Please email support@breakwatch.dev and we'll respond promptly. Please don't publicly disclose until we've had a chance to fix it.