This page sets out the security measures EMRules has in place today.
Connections. emrules.com, app.emrules.com and api.emrules.com are served over HTTPS only. Every request to these hosts passes through Cloudflare, which decrypts it, then encrypts it again on its way to our servers and checks their certificate. Our pages and API tell browsers to keep using HTTPS, not to guess file types, and not to show our pages inside other sites.
Your workspace's data. Your account and your workspace's data are stored in a Postgres database run by Supabase. Row-level security is on for every one of our tables, and our services connect as database roles that own no table and cannot bypass it. Our application reads your workspace's members, with their names and email addresses, and its API keys, usage and billing records through a role that sees only the workspace a request is bound to. Our sign-in service uses a second role, the only one of ours that can read passwords, sessions and sign-in tokens; it also manages members, invitations and API keys across workspaces. Our operators can read all records to run the service. Automated tests check that one workspace cannot read another's records. The regulatory records are shared by every workspace.
Passwords, API keys and sign-in tokens. Passwords are stored only as scrypt hashes, each with its own random salt. API keys are stored as SHA-256 hashes. A key is shown in full once, when it is created, and we keep only its first six characters in readable form, oc_ and three more, so you can tell your keys apart. When you sign in with Google or Microsoft, the access and refresh tokens they issue are stored encrypted (XChaCha20-Poly1305), and the ID token is not kept. If you think a key is exposed, revoke it and create a new one.
Backups. Our Supabase plan includes no backups. We copy the database ourselves every week and before every database migration, and keep the copies outside the systems that run the service. Each copy holds all of our tables, sign-in records included. A restore returns the database to the newest copy, so changes made after it would be lost. We do not yet remove old copies on a schedule, so data you delete can remain in copies made before the deletion. We last rehearsed a restore of our tables into a separate database on 26 September 2026.
Documents we collect. The documents we collect from regulators are stored in a private Cloudflare R2 bucket. Of our services, only the processing pipeline holds a key to it, and we do not distribute these files.
Providers. The providers that process your personal data for us are listed in our Privacy Policy. Some of them process data outside the European Economic Area, as it describes.
What we do not offer. We hold no security certification, such as SOC 2 or ISO 27001, and we make no uptime commitment.
Reporting a problem. To report a security problem, write to [email protected] with what you found and the steps to reproduce it.
This page describes our measures; it is not a warranty. Our Terms govern.