Skip to content
Hansala
Search
Loading account

Trust

Security

Last updated 6 August 2026

Hansala is built so confirmed evidence cannot be published by a single party. The practices below describe what the product and infrastructure actually do — not aspirational certifications.

Authentication

  • Sign-in uses Supabase Auth (magic link / password as configured).
  • Sessions use HTTP-only cookies with SameSite=Lax; production shares cookies across www and apex via .hansala.com when configured.
  • Agent API keys use the hs_ prefix and are stored as SHA-256 hashes — the raw key is shown once at creation.

Authorization

  • Postgres row-level security and company operator checks scope data to the owning company.
  • Sensitive writes go through SECURITY DEFINER RPCs granted to service_role, not broad client grants.
  • The service-role admin client is never imported from client components.
  • Confirmations (partners, references, case studies) require a human action — Agent API can invite, not confirm for the other side.

Encryption in transit

Production traffic is served over HTTPS (TLS) via the hosting provider. We do not document application-level encryption of database fields in this repository.

Data access controls

  • Public API and embeds expose only confirmed / published fields.
  • Staff admin access is dual-gated (allow-listed emails plus platform_staff rows) when configured.
  • Outbound fetches of user-supplied URLs go through a safe-fetch helper with timeouts and SSRF protections.

Backups

This codebase does not implement or document a Hansala-owned backup product. Database durability depends on the linked Supabase project plan. We do not claim PITR or encryption-at-rest here unless separately confirmed with the provider.

Domain verification & “Verified”

A company can prove control of its business domain via email domain match, DNS TXT, or a meta tag on its website. Staff may also mark approved identity in exceptional cases through internal tools.

Verified means the company controls its business domain or approved identity. It does not mean Hansala guarantees the quality of its services.

Incident reporting

Email security@hansala.com. For researcher process and scope, see responsible disclosure. Machine-readable: /.well-known/security.txt.

Data deletion

Account and personal data deletion is by email request — there is no self-serve delete control yet. Details: data deletion.

More

Privacy · Subprocessors · Status