Security at RELTO
Your property images and personal data are protected at every layer. We treat security as a core product requirement, not an afterthought.
Encrypted in transit and at rest
TLS 1.3 in transit · AES-256 at rest
TLS 1.3
In-Transit Encryption
AES-256
At-Rest Encryption
15 min
P0 Response Target
7 years
Audit Log Retention
How We Protect Your Data
Multiple layers of defense protect your images and information from upload to storage.
Encryption Everywhere
All data is encrypted in transit with TLS 1.3 and at rest with AES-256 encryption. Your images are never transmitted or stored in plaintext.
SOC 2-Certified Providers
Built on SOC 2-certified providers including Supabase, Vercel, and Stripe. RELTO does not hold its own SOC 2 certification.
Audit Logging
Every access to sensitive data is logged with actor, action, resource, and timestamp. High-sensitivity audit logs are retained for 7 years.
Security Practices
Authentication & Access Control
- Supabase Auth with Row Level Security (RLS) enforced on every database table
- Multi-admin support with timing-safe comparison to prevent brute-force attacks
- Rate limiting on all endpoints: 200 req/min for users, 60 req/min for admin routes
- Development authentication bypasses are blocked in production environments
Application Security
- Input validation using Zod schemas on all API endpoints
- SSRF protection with DNS resolution checks and private IP blocking
- XSS sanitization on all user-generated content
- Content Security Policy (CSP) with per-request nonces
- All debug routes blocked in production environments
Payment & Billing Security
- Stripe handles all payment processing - we never store card numbers
- Atomic database operations prevent race conditions in credit deduction
- Idempotency keys on all credit operations prevent double-charges
- Automatic refunds if downstream operations fail after charge
Image & Data Handling
- Property images are processed ephemerally - raw uploads are not retained after staging
- Generated images stored in encrypted cloud storage with access-controlled URLs
- Subdomain/tenant isolation with Unicode normalization to prevent homograph attacks
- Strict CORS and origin validation on all API routes
Infrastructure Partners
We build on independently audited infrastructure.
Supabase
Database & Auth
SOC 2 Type IIVercel
Hosting & Edge
SOC 2 Type IIStripe
Payments
PCI DSS Level 1Upstash
Redis & Queue
SOC 2Incident Response
We maintain a formal incident response plan with defined severity levels (P0-P3), on-call rotations, and clear escalation paths. Critical incidents target a response within 15 minutes. Our breach notification procedures follow GDPR Article 33 (72-hour notification) and CCPA requirements.
To report a security concern, contact us at security@relto.app
Certification & Compliance Roadmap
Where we are today and where we're headed.
SOC 2-Certified Infrastructure
ActiveAll core providers (Supabase, Vercel, Stripe, Upstash) hold SOC 2 Type II or PCI DSS certifications.
GDPR & CCPA Alignment
ActiveData subject rights support, DPAs with core vendors, 30-day response commitment.
Security Audits & Audit Logging
ActiveAudit trails with 7-year retention. Recurring internal security assessments.
SOC 2 Type 1 (RELTO)
In ProgressPursuing our own SOC 2 Type 1 certification to complement our vendor certifications.
Questions About Security?
We are happy to discuss our security practices in detail. Enterprise customers can request our full security documentation and vendor assessment questionnaire.