How We Protect Your Data
Capsulate implements industry-standard security measures across every layer of the platform:
Encryption
- In transit: All connections use TLS 1.2 or higher (HTTPS). API calls between the client, server, and third-party services are encrypted end to end.
- At rest: Database storage is encrypted with AES-256. Gmail OAuth tokens are encrypted with a separate key before being stored.
Authentication and Access Control
- OAuth 2.0: We never see or store your Google password. Gmail access is granted through Google's OAuth consent flow and can be revoked at any time.
- Row-Level Security (RLS): Database policies ensure that every query returns only the authenticated user's own data.
- JWT-based sessions: Server endpoints verify signed tokens on every request.
Infrastructure
- Application servers run on Fly.io with isolated containers and automated health checks.
- Database hosted on Supabase (managed PostgreSQL) with daily backups and point-in-time recovery.
- Secrets and API keys are stored as encrypted environment variables, never in source code.
Monitoring and Incident Response
- Continuous monitoring for suspicious activity and error spikes.
- Automated alerts for authentication anomalies and system failures.
- Defined incident response procedures with prompt user notification when applicable.
Report a Vulnerability
If you discover a security issue, please report it to security@capsulate.app.
Include reproduction steps, affected endpoints or pages, impact assessment, and any proof-of-concept details.
Disclosure Expectations
- Do not access or modify data that does not belong to you.
- Do not perform disruptive testing against production systems.
- Give us a reasonable window to investigate and remediate.
Response Timeline
- Initial triage response target: 3 business days.
- Status updates for confirmed issues during remediation.