This page summarises the security measures and data-protection practices that protect your information on PianoLabs. It is intended for users, prospective enterprise customers, and security researchers. It supplements our Privacy Policy.

1. Encryption

All traffic between your device and PianoLabs is encrypted with TLS 1.2 or higher. We redirect plain HTTP requests to HTTPS and use HSTS to prevent downgrade attacks.
User data is stored in encrypted databases at rest using AES-256.
Passwords are hashed using bcrypt (cost factor at the current industry default) by our authentication provider, Supabase. We never see or store your plaintext password.
Secrets, API keys, and service credentials are stored in environment-isolated secret managers and are never committed to source control.

2. Hosting and infrastructure

Our database, authentication, and storage layer is Supabase, hosted on AWS infrastructure. Hosting region is selected to balance EU and African latency; the specific region is disclosed to enterprise customers under NDA.
Payments are processed by Paddle, our PCI-DSS-compliant merchant of record. PianoLabs never stores full card numbers, CVV codes, or bank account numbers on its own systems.
Backups are taken daily, encrypted, retained for 30 days, and stored in a separate geographic region.
We do not run our own data centres or physical servers.

3. Access controls

All database tables enforce Row-Level Security (RLS) so users can only access their own records. RLS policies are reviewed each time the schema changes.
Admin access to production systems is restricted to a small number of authorised personnel listed in an internal access register. All admin access requires multi-factor authentication.
Real-time replication channels exclude sensitive tables (profiles, subscriptions, billing records) to prevent inadvertent data leakage to subscribed clients.
Production-database access is logged and reviewed.

4. Application security

We follow a secure development lifecycle: peer code review, automated dependency vulnerability scanning, automated test suites, and pre-release security review of major features.
Inputs are validated server-side. Output that could be rendered as HTML is escaped to prevent cross-site scripting.
We use Content-Security-Policy and other security headers on the website.
The API is rate-limited to limit credential-stuffing and abuse.

5. Vulnerability management and responsible disclosure

We welcome responsible-disclosure reports. To report a vulnerability:

Email support@pianolabs.io with the subject line "Security — Responsible Disclosure".
Include a clear description, reproduction steps, and any evidence (screenshots, proof-of-concept code).
Give us a reasonable time to investigate and patch before public disclosure. We aim for an initial response within 2 business days and a coordinated disclosure timeline of up to 90 days, longer where the issue is complex.
Please do not access, modify, or delete data that is not your own; do not run scans that degrade service for other users; do not socially engineer staff or users; and please act within South African law.

We do not currently operate a paid bug-bounty programme but we recognise researchers in our Hall of Thanks where they consent.

6. Breach notification

In the event of a personal-information breach that is likely to result in a risk to your rights and freedoms:

Under POPIA section 22, we will notify the South African Information Regulator and affected users as soon as reasonably possible after we become aware of the breach and have established the basic facts.
Under GDPR Article 33, we will notify the relevant EU supervisory authority within 72 hours of becoming aware of the breach where it is likely to result in a risk to data subjects.
Under UK GDPR, the same 72-hour timeline applies to notification of the UK Information Commissioner.

Our breach notification will include, where known: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures we have taken or plan to take to address it.

7. Sub-processors

We rely on the following sub-processors, all bound by data-processing agreements:

Supabase Inc. — authentication, database, storage.
Paddle.com Market Ltd — merchant of record and payment processing.
Google LLC — OAuth (only if you choose Google sign-in).
Lovable AI Gateway — AI-assisted features.
[INSERT TRANSACTIONAL EMAIL PROVIDER] — account and billing email delivery.
[INSERT ANALYTICS PROVIDER, IF USED] — anonymised product analytics (only after consent).

We will give at least 30 days' notice in this page (or by email to enterprise customers) before adding or replacing a sub-processor that processes personal data. Enterprise customers may request a formal Data Processing Addendum and the current sub-processor list.

8. Business continuity

We maintain a documented incident-response plan and conduct internal exercises against it. Backups are tested for restorability at least quarterly. In the event of provider outage we restore from the most recent backup and communicate status updates on our status page.

9. What you can do to keep your account safe

Use a strong, unique password and a password manager.
Turn on two-factor authentication (Profile → Security → 2FA).
Do not share your credentials and do not log into PianoLabs from devices you do not trust.
Sign out of shared devices.
Watch for phishing — official PianoLabs emails come from @pianolabs.io and never ask for your password.

10. Contact

Security questions or formal documentation requests: support@pianolabs.io with the subject line "Security".