Security Overview
Effective: Last updated 2026-09-19 · Version: 2026-09-19
1. Architecture
Tomonagi runs on Render with a Supabase-hosted PostgreSQL database, all in the United States. Every workspace is a tenant in a shared database; every query the application makes carries the tenant's identifier as an explicit filter, and automated tests fail the build if a new query is written without one. Files are stored in tenant-prefixed folders in private buckets and are served only through short-lived signed links.
2. Encryption
All traffic between your browser, our servers, and our providers uses TLS. Data at rest is encrypted by our database and storage providers. Credentials for accounts you connect (Gmail, payment processors, SMS carriers) are additionally encrypted with AES-256-GCM using a key held outside the database, so a copy of the database alone cannot expose them.
3. Access control
Users sign in with email and password or a magic link; sessions expire and refresh on a short cycle. Within a workspace, roles limit who can see settings, billing, and other people's records, and access grants let an owner scope a person to specific modules. Customer-facing links (portal, forms, signing, booking, payment) carry a random token that is the only way to reach that page; tokens can be revoked and may be set to expire.
4. Monitoring and audit
Administrative actions are written to an audit log you can read in your workspace; retention depends on plan. Server errors are captured centrally and reviewed. Inbound webhooks from carriers and processors are signature-verified before they are trusted; unsigned or mismatched requests are rejected.
5. Backups and continuity
Our database provider takes automated backups. Independently of that, any workspace owner can export the entire workspace as JSON from Admin → Backup at any time and re-import it later; we recommend doing so on a schedule that matches how often your data changes.
6. Vulnerability reports
If you find a security problem, email jbyron@tomonagi.com with enough detail to reproduce it. We will acknowledge within two business days, keep you informed, and not pursue good-faith researchers who avoid privacy violations, data destruction, and service disruption.
7. Your part
Use a strong, unique password; keep your team list current and remove people who leave; treat customer-facing links as the keys they are; and export a backup before large imports or migrations. Security is shared, and most incidents on any platform begin with a reused password.