How GHMAP protects workspace and service data

• Connections to ghmap.io and app.ghmap.io use TLS. Credentials and workspace payloads are not sent in clear text.
• Workspace records and uploaded files are held in managed Supabase Postgres and object storage, which encrypt data at rest.
• Public demo and inquiry forms collect business contact and product context only. GHMAP does not ask for bank details, patient records, or confidential contracts through them.
• Encryption alone does not keep one organization's records away from another. That is the isolation model in control 02.

• Shared workspace records carry the organization they belong to, and access is scoped to it. Meeting records created before organization scoping was introduced stay scoped to their host and participants until they are reviewed and assigned.
• Row Level Security is enabled on every workspace table. On the tables that carry row policies — including profiles, workspace membership, organizations, items, submissions, help requests, and billing records — Postgres evaluates those policies on each query made with a member session, and they resolve membership and role through database functions rather than inline conditions.
• Meeting and relationship-network tables have Row Level Security enabled but no row policies defined, so a member session reads no rows from them directly. These surfaces are served only by server routes that use a privileged service connection, which is not subject to Row Level Security, and that resolve meeting access, organization membership, and role in application code before any record is returned. For these tables the isolation boundary is the server route, not a database policy.
• Membership is stored per organization, not per user, so the same person can hold a different role in a different organization.

• Workspace access is invite-based or otherwise reviewed. There is no open self-registration into operational data.
• Creating an account does not grant workspace access; membership must be granted separately.
• Supabase Auth issues and verifies sessions. Application code resolves a session to an organization membership and a role before returning workspace data.
• A membership carries an explicit role and status, and administrative changes to an organization are restricted to its owners and admins.
• Public pages on ghmap.io require no session and render no organization-scoped records. Authenticated workspace behaviour stays on app.ghmap.io.

• Send findings to security@ghmap.io with reproduction steps that do not require access to another customer's data.
• Do not access data that is not yours, degrade service availability, or attempt social engineering of GHMAP users or staff.
• Allow a reasonable review period before discussing a finding publicly.
• GHMAP does not run a paid bug bounty programme. Reports are still welcome and are treated as coordinated disclosure.

Report privately to security@ghmap.io.