Security
Last updated 20 June 2026
This document is a practical first draft and REQUIRES LEGAL REVIEW. Replace every bracketed placeholder and confirm the content with a qualified adviser before relying on it.
Security is foundational to ServiceFollow. This page summarises the controls we use to protect your account and your customers' data.
Data protection
- Encryption in transit (TLS) for all traffic between your browser, our app and our providers.
- Tenant isolation enforced at the database layer with row-level security, so each account can only read and write its own records.
- Service-role access is restricted to trusted server-side operations (AI drafting and scheduled follow-ups) and never exposed to the browser.
Authentication
- Authentication and session management are handled by Supabase Auth.
- Sessions use secure, HTTP-only cookies and are validated on the server for protected routes.
- Passwords are never stored by us in plain text.
Payments
Card payments are processed by Stripe, a PCI-DSS Level 1 certified provider. We never see or store full card numbers — only a Stripe customer reference and subscription status.
Infrastructure
The application is hosted on Vercel with managed Postgres via Supabase. Scheduled jobs are protected by a secret bearer token so they cannot be triggered by unauthorised callers.
Responsible disclosure
If you believe you have found a security vulnerability, please email security@servicefollow.com. We will acknowledge your report and work with you to resolve the issue. Please do not publicly disclose until we have had a reasonable opportunity to remediate.