Security Policy

1. Introduction

Solution takes the security of member data seriously. This Security Policy describes the measures we actually have in place to protect information, and how we handle security issues when they arise.

We describe our practices here honestly rather than aspirationally. Where a control is provided by an infrastructure partner rather than operated by us, we say so.

​

2. Scope

This policy applies to the Solution mobile applications, our website, and the backend systems and third-party services that support them. It applies to our personnel and to contractors who are given access to our systems.

​

3. Infrastructure

Solution does not operate its own physical servers, data centres, or network infrastructure. Our application and database are hosted by Supabase, which runs on established cloud infrastructure. Physical security, network-level protection, operating system patching, and infrastructure hardening are performed by our infrastructure providers under their own security programs and certifications.

Our responsibility is the security of what we build on top of that infrastructure: the application, the database schema and its access rules, our use of credentials, and the third-party services we connect.

​

4. Data protection

Encryption in transit. All traffic between the application and our backend is encrypted using industry-standard TLS.

Encryption at rest. Data stored in our database and file storage is encrypted at rest by our infrastructure provider.

Payment data. We do not collect, receive, or store payment card details. Subscriptions are purchased through the Apple App Store or Google Play, and those stores handle the payment method and transaction.

Credentials and secrets. Account passwords are handled by our authentication provider and are not stored by us in readable form. Server-side secrets are held in encrypted secret storage rather than in application code, and privileged credentials are never included in the mobile application.

​

5. Access control

Database access control. Access to member data is enforced at the database level using row-level security. Access rules are defined per table, so a request can only reach the records that the authenticated member is entitled to see, regardless of how the request is made. Privileged server-side operations run only in server-controlled functions, never in the mobile application.

Personnel access. Access to production systems and member data is limited to personnel who require it for their role. We keep the number of people with privileged access small.

Authentication. Members authenticate by email and password, or by Apple or Google sign-in. Session handling is managed by our authentication provider, with credentials stored in the device's secure storage.

​

6. Application security

Security review. We review our own systems for security weaknesses, including reviews of database access rules, server-side functions, and application code. Findings are recorded and remediated. We do not currently operate automated static or dynamic application security testing, and we do not hold a third-party security certification such as SOC 2 or ISO 27001.

Dependencies. We monitor the third-party libraries we depend on and update them as part of routine maintenance.

Error monitoring. We use an error monitoring service to detect application faults and crashes. This is a reliability tool; it is not a dedicated security monitoring or intrusion detection system.

​

7. Incident handling

If we become aware of a security incident affecting member data, we will investigate promptly, take steps to contain and remediate it, and assess what data and which members are affected.

Where a personal data breach occurs, we will notify the relevant supervisory authority and affected individuals where, and within the timeframes, required by applicable law. See our Privacy Policy for more detail.

We are a small team and do not maintain a formal 24-hour security operations function.

​

8. Third-party services

We rely on third-party providers to operate the Service, listed in our Privacy Policy. We select established providers and rely on the security programs and contractual commitments they publish. We do not conduct independent security audits of our providers.

​

9. Reporting a vulnerability

If you believe you have found a security vulnerability in Solution, please report it to Offices@Solution4u.com with enough detail for us to reproduce it. We ask that you give us a reasonable opportunity to investigate and remediate before disclosing publicly, and that you do not access, modify, or delete data belonging to other members while investigating.

We will acknowledge reports we receive and keep you informed of the outcome where appropriate. We do not currently operate a paid bug bounty program.

​

10. Personnel

People with access to production systems or member data are subject to confidentiality obligations. Access is granted according to role and removed when no longer required.

​

11. Data retention and deletion

Members can delete their account at any time from within the app. What is removed, and what may be retained where legally required or reasonably necessary, is described in our Privacy Policy.

​

12. Changes to this policy

We review this policy periodically and update it as our systems and practices change. Where a change is material, we will provide notice in accordance with our Terms & Conditions.

​

13. Contact

Security questions and vulnerability reports: Offices@Solution4u.com.