Security Policy

Our Security Philosophy

Data security is a core pillar of our habit-tracking and productivity suite. We build on enterprise-grade infrastructure to ensure your records, focus sessions, and credentials remain private and secure.

1. Infrastructure & Hosting

Growtree's backend database and authentication layers are powered by Supabase. Supabase databases run on isolated containerized environments hosted by Amazon Web Services (AWS) with strict system firewalls and auto-updating security layers.

2. Data Encryption

• In Transit: All data sent to and from our site is encrypted using Transport Layer Security (TLS/HTTPS).
• At Rest: Databases, including backup files, are encrypted at rest using AES-256 standard encryption keys.

3. Authentication & Sessions

User authentication is managed directly through Supabase Auth via secure JSON Web Tokens (JWT). We support sign-ins via Google OAuth, which ensures password security is maintained by Google's top-tier authentication systems. We never see or store your raw passwords on our servers.

4. Vulnerability Disclosure

If you believe you have discovered a security vulnerability in Growtree, please email us directly at [email protected]. Please include details of the vulnerability and steps to reproduce. We request that you give us a reasonable timeframe to resolve the issue before disclosing it publicly.