Trust & security

• Four roles: founder, mentor, startup success manager, admin. Roles live in a separate table and are checked through a security-definer function to avoid recursive policy errors.
• Row-level security is enabled on every user-owned table; policies scope reads and writes to auth.uid() or a matching role check.
• Private mentor notes are stored on separate columns/tables from founder-visible summaries.

• All traffic to the app and API uses TLS.
• User files live in the backend's object storage; direct URLs are not public — access is issued through short-lived signed URLs when a signed-in user requests them.
• Backups are handled by the managed backend platform on a rolling window.

• Server-side schema validation (Zod) on every state-changing server function.
• All database access goes through the parameterised Supabase client — no string-built SQL.
• React escapes rendered output; we do not use dangerouslySetInnerHTML with user content.
• Sessions expire on the timeline set by the auth provider; sign-out clears client caches.
• Secrets are stored in the platform's secret manager and read only in server-side handlers.

• Admin actions (pipeline updates, bulk messages, note edits, deletion requests) are written to an append-only audit log with actor, action, entity, and timestamp.
• Founders can see every consent they've granted from the Profile page.

We do not describe Bottleneck as "bank-grade", "military-grade", or "state-of-the-art" — those phrases are marketing, not controls. We do not currently hold SOC 2, ISO 27001, HIPAA, or PCI attestations. If your organisation requires one, please contact us before onboarding.

If you've found a security issue, please email security@bottleneck.fit with steps to reproduce. We acknowledge reports within two business days and will not pursue researchers acting in good faith.