Security
Allocate stores shared expenses, so we designed it to hold as little sensitive data as possible and to guard what it does hold. This page describes the architecture, the controls in place, and the results of our most recent security self-audit.
Architecture in one paragraph
The iOS app talks directly to Supabase over TLS. Supabase provides authentication, a Postgres database, and file storage. There is no custom server of ours in between — every database query runs under the signed-in user's identity and is filtered by row-level security policies in Postgres itself, so access control is enforced in the database rather than in app code.
Controls
| Area | Control |
|---|---|
| Transport | All app, website, and API traffic is encrypted with TLS (HTTPS). No plaintext endpoints. |
| Access control | Postgres row-level security on every table: you can only read and write groups you are a member of. Storage buckets require signed URLs. |
| Authentication | Supabase Auth with email + password (bcrypt-hashed, never stored in plaintext, minimum length enforced, email confirmation required) and native Sign in with Apple using a cryptographic nonce to prevent token replay. |
| Password recovery | Reset links are single-use, expiring, and open the app directly over a registered deep link. |
| Secrets | API keys are excluded from source control. Only the publishable (public-safe) key ships in the app; privileged keys never leave the dashboard. |
| Data minimization | No location, contacts, phone numbers, ad identifiers, or payment credentials are collected. Texting an invite uses your own Messages app. |
| Encryption at rest | Database and file storage are encrypted at rest by our infrastructure provider (AES-256). |
| Account deletion | Self-service in the app; removes profile, memberships, and orphaned groups via a security-definer database routine. |
Latest self-audit
Reviewed Sep 2026
| Check | Status |
|---|---|
| Row-level security enabled on all tables | ✅ Pass |
| No privileged keys in the client or repository | ✅ Pass |
| All endpoints HTTPS-only | ✅ Pass |
| Apple sign-in nonce validated server-side | ✅ Pass |
| Email confirmation required for new email accounts | ✅ Pass |
| Password reset links single-use and expiring | ✅ Pass |
| Group data inaccessible to non-members (tested with second account) | ✅ Pass |
| Independent third-party penetration test | ◻ Planned |
This is a self-assessment by the developer, re-run before each App Store release. An independent review is planned as the app grows.
Responsible disclosure
Found a vulnerability? Please email support@allocate.example with the details. We will acknowledge within 72 hours, keep you updated while we fix it, and credit you if you'd like. Please don't access data that isn't yours or disrupt the service while testing.
Incident response
If a breach affecting personal data ever occurs, we will notify affected users by email and post a notice on this page, including what happened, what data was involved, and what we are doing about it.