Security at FurniHub
A plain description of how we protect your data today, and what we do not claim.
How we protect your data
FurniHub is a young product run by a small team. We rely on established providers for the hard parts and keep access to member data narrow.
Encryption
Traffic between your browser and FurniHub is sent over HTTPS. Stored data is encrypted at rest by our database provider.
Authentication
Sign-in and password handling are provided by Supabase Auth. Passwords are never stored by FurniHub in readable form.
Access control
Members only see what their role and company allow. Access rules are enforced in the database with row-level security, and admin tools are limited to admin accounts.
Payments
Card payments are handled by Stripe on its own hosted checkout. Card numbers go to Stripe, not to FurniHub.
Hosting
The application runs on managed cloud hosting, and member data is stored in a managed Postgres database provided by Supabase. We do not run our own servers.
Sessions
Signed-in sessions in the member area time out after a period of inactivity, with a warning before you are signed out.
What we do not claim
We would rather be clear about the limits than imply protections we cannot show.
- We do not hold SOC 2, ISO 27001, or any other formal security certification.
- We have not published an independent security audit or penetration test.
- We do not currently offer multi-factor authentication.
- We do not publish an uptime guarantee or service level agreement.
How we handle personal information is described in our Privacy Policy.
Report a security concern
If you believe you have found a vulnerability or a problem with how your data is handled, please tell us. Use the contact form or email hello@furni-hub.com with "Security" in the subject line. Please include enough detail to reproduce the issue and avoid accessing other members' data while testing.