Security & privacy practices

Tenancy and access control

Workspace separation is enforced in the database, not in the interface, so a bug in a screen cannot expose another artist's data.

• Row-level security is enabled on artist-owned tables, and policies scope every read and write to the active workspace.
• Workspace roles (owner, admin, manager, editor, viewer) decide what a member can do; viewers are read-only.
• Sensitive operations — billing, membership, payouts, invitations — are checked server-side, not only hidden in the UI.
• Privileged database functions run with pinned search paths and are executable only by the roles that need them.

Credentials and secrets

• Passwords are handled by Supabase Auth; Amplify never stores or sees a plaintext password.
• Service-role, Stripe, AI provider and email keys exist only in server-side environments and are never shipped to the browser.
• Team invitations are stored as token hashes, so a database read cannot reveal a usable invitation link.
• Card details are entered on Stripe surfaces; Amplify does not store payment instruments.

Data handling

• All traffic is served over HTTPS. Data at rest is stored in Supabase's managed Postgres and object storage.
• Private files are served through signed, expiring URLs rather than public links.
• Uploads are checked for type, size, ownership and destination path before they are accepted.
• Money is stored as integer cents to avoid rounding drift, and financial workflows use atomic database operations.
• Stripe webhooks are signature-verified and deduplicated before any subscription or order state changes.

Traceability

• Meaningful workspace actions are written to an activity log with the acting user and timestamp.
• Support requests, notifications and integration sync runs keep their own records so a workspace can see what happened.
• Automated checks run against the security-sensitive database logic on every change to it.

Tracking

• No advertising trackers, third-party analytics scripts or cross-site pixels are loaded.
• Browser storage is functional only: the auth session, the last active workspace, layout preferences, an anonymous press-kit view identifier, and a sidebar state cookie.
• Amplify does not use artist content, fan data or business records to train AI models.

What has not been established

Stating this plainly matters more than looking finished.

• No SOC 2, ISO 27001, PCI, HIPAA or comparable audit has been performed, and none is claimed.
• No independent penetration test or third-party security assessment has been completed.
• GDPR, CCPA and similar regulatory readiness has not been reviewed by counsel; a formal subprocessor list and data-processing terms are still outstanding.
• There is no uptime commitment or service credit during the founding beta.
• Backup restoration is exercised informally and does not yet have a documented recovery-time objective.

Reporting a vulnerability

Email security@amplifyforartists.com with enough detail to reproduce the issue. Please give us a reasonable window to fix it before disclosing publicly, and do not access, alter or retain another artist's data while testing. We will confirm receipt and tell you what we found.