Security

Proposal Core is built as a Nuxt web application and is designed to run on managed cloud hosting. Production infrastructure should be configured to serve the application over HTTPS only.

The application uses Supabase for authentication, database services and storage-oriented document workflows.

• Traffic should be encrypted in transit with HTTPS.
• Supabase-managed services provide encryption controls for stored database and storage data.
• Proposal Core avoids exposing service role credentials to the browser.

User authentication is handled through Supabase Auth. The application currently supports email based one-time passcodes for login and registration.

Protected product pages require an authenticated browser session before the user can access application data.

Proposal Core uses organization workspaces with roles such as owner, admin, manager, member and viewer.

Server-side permission checks restrict sensitive actions such as billing, invitations, document archive operations and workspace administration.

Customer records are scoped to organization workspaces. API handlers require an active organization context for workspace data requests.

Supabase row level security and server-side checks are used to help keep workspace data separated.

Database and storage backup behavior depends on the configured Supabase project plan and operational settings.

Customer deletion and retention requests are handled according to the Privacy Policy, Data Processing Agreement and applicable legal obligations.

The application stores immutable activity records for important proposal and organization events.

Server errors are logged internally and sanitized before being returned to users.

If Proposal Core identifies a security incident affecting customer data, the team will investigate, contain the issue, assess the impact and communicate with affected customers as required by law and contract.

Customers should report suspected security issues promptly through security@proposal-core.com.

Reports should include the affected URL or feature, reproduction steps, the potential impact and a safe proof of concept where possible.

Do not attempt to access data that does not belong to you, disrupt service availability or use automated scanning that could affect other users.