Security

Security is built into how we design, build, and operate the Services. This page summarizes the safeguards we use to protect your data and the integrity of our platform. It complements our Privacy Policy and Terms of Service.

Last updated: July 22, 2026.

Infrastructure and hosting

Our application is hosted on managed, security-hardened cloud platforms. The web application runs on Vercel, and our database and authentication run on Supabase, which is hosted on Amazon Web Services. These providers maintain their own certified physical, network, and operational controls. We favour managed services so that patching, isolation, and hardening are handled by specialized providers.

Encryption in transit

All traffic to the Services is served over HTTPS, and we enforce HTTP Strict Transport Security so browsers only connect over encrypted channels. Data exchanged with our database and service providers is likewise protected in transit using industry-standard TLS.

Application security

We apply a strict Content Security Policy with a per-request nonce to reduce the risk of cross-site scripting, and we set our authentication cookies with secure and same-site attributes. Requests are validated against strict schemas on the server, and sensitive endpoints are rate limited using a distributed counter to slow abuse and credential-stuffing attempts. Redirect targets are sanitized to prevent open-redirect abuse.

Authentication

• Passwords are never stored in readable form; they are hashed by our authentication provider.
• New and changed passwords are checked against known breach corpora using k-anonymity, so that neither your full password nor your email address is disclosed during the check.
• We support phishing-resistant passkeys (WebAuthn), with single-use, short-lived challenges.
• We support time-based one-time-password multi-factor authentication, and we enforce a second factor on protected areas when you have one enrolled.
• You can sign in with trusted providers (Google, Microsoft, or LinkedIn) if you prefer federated authentication.

Authorization and data isolation

Our database is protected with row-level security, so records are accessible only to the accounts entitled to them. Privileged credentials, such as service-role keys, are isolated to server-side systems and are never exposed to the browser. Access follows the principle of least privilege.

Payments

Payments are handled by certified processors, currently Stripe and PayPal. Card data is entered directly with those processors and never touches our servers, which keeps sensitive cardholder data out of our environment.

Protecting stored data

Files are stored in private buckets and are served through signed, short-lived download links rather than public URLs. We collect only the data we need, retain it only as long as necessary, and restrict internal access to those who require it to operate the Services.

Monitoring and response

We log relevant events, monitor for anomalies, and maintain processes to investigate and respond to potential incidents. If a security incident affects your personal information, we will notify you and the appropriate authorities as required by applicable law, including Canadian and United States breach-notification requirements.

Responsible disclosure

We welcome reports from security researchers. If you discover a vulnerability, please report it responsibly to security@dnatechnology.ca and allow us a reasonable time to investigate and remediate before any public disclosure. Please avoid privacy violations, service disruption, and data destruction while testing. We will not pursue legal action against researchers who act in good faith and follow this policy.

Your part in security

You can help protect your account by using a strong, unique password, enabling a passkey or multi-factor authentication, keeping your devices and browser up to date, and being alert to phishing. Never share your credentials, and contact us right away if you notice anything unusual.

Contact

For security questions or reports, contact security@dnatechnology.ca. For privacy matters, contact privacy@dnatechnology.ca.