🔒 Security

Infrastructure & Hosting

🗄️ Supabase — All user data stored in PostgreSQL on AWS EU West. SOC 2 Type II certified. See supabase.com/security.

🌐 Netlify — App served via global CDN with automatic HTTPS. SOC 2 Type II certified. See netlify.com/security.

✉️ Resend — Invitation emails sent via Resend. Email addresses used solely for delivery. See resend.com/privacy.

Encryption

• In transit: All communication uses TLS 1.2+ (HTTPS).
• At rest: All data encrypted using AES-256.
• Passwords: Never stored in plain text — handled by Supabase Auth using bcrypt hashing.

Access Control

Your data can only be seen by you and people you explicitly invite. We enforce this at the database level using Supabase Row-Level Security (RLS), meaning no other user — or even our own staff — can query your records.

Authentication

Sign in via Supabase Auth with short-lived JWTs and secure refresh token rotation. Password resets use the PKCE flow to prevent interception attacks.

Data Location

All personal data is stored within the EU/UK region (AWS EU West). Data is not transferred outside this region except where explicitly noted.

No Third-Party Sharing

We do not sell, rent, or share your data for advertising or commercial purposes. Your health information is never used to train AI models.

Your Data & Deletion

Permanently delete your account and all data at any time from Settings → Delete My Account. Records are removed immediately; any Supabase infrastructure backups are fully purged within 30 days.

Security Summary

🔒 TLS 1.2+  ·  🔐 AES-256  ·  🛡️ Row-level security  ·  🇬🇧 UK/EU data  ·  🚫 No ads  ·  ✅ SOC 2 infrastructure

Report a Security Issue

Contact us immediately at support@mycancerjourney.co.uk. We aim to respond within 24 hours.