Agent rosters are personal data. Here’s how we protect them.

Isolation enforced by the database

• Row-level security is switched on for every table. Policies check that the workspace belongs to you before a row is returned, inserted, changed or deleted.
• Ownership checks live in the database (owns_workspace, owns_forecast), with a pinned search path on every privileged function.
• The interface also hides pages from signed-out visitors, but that’s a convenience — the database is the control.

create policy "Workspace owners manage agents" on public.agents
  for all to authenticated
  using (public.owns_workspace(workspace_id))
  with check (public.owns_workspace(workspace_id));

Passwordless sign-in

• You sign in with a one-time 6-digit code sent to your work email. There is no password to reuse, phish or leak.
• Sessions live in cookies and are re-validated on the server: tokens are verified by signature on every request, not trusted from the browser.
• Too many attempts are rate-limited, and a wrong or expired code is never confirmed either way.

Infrastructure

• The application is hosted on Vercel; data and authentication run on Supabase’s managed Postgres.
• Every connection uses TLS. Data and backups are encrypted at rest with AES-256 by the database provider.
• Secrets stay on the server; the browser only ever holds a publishable key that row-level security constrains.

Privacy by design

• No third-party AI. Every number — Erlang C, the hours chain, coverage and suggestions — comes from our own code.
• No analytics, advertising or tracking cookies on the site or in the app.
• Agents listed in a workspace don’t get accounts; only the planners who sign in do.

You stay in control

• Deletes and imports can be undone, and a failed save is rolled back exactly — nothing half-written is left behind.
• Sample data is marked as such and cleared in one click.
• Ask us for a copy of your workspace’s data, or for its deletion, at any time.