Security

Loyal League runs on Supabase (Postgres, auth and object storage) hosted on AWS in eu-west-1 (Ireland). The web application is served from a global edge network; primary data storage stays in the EU region above.

All traffic is served over HTTPS with TLS 1.2 or higher, including public capture pages and file downloads. Data at rest — database, backups and storage buckets — is encrypted with AES-256. Passwords are never stored in plain text; authentication is handled by Supabase Auth with hashed credentials.

• Row-level security on every table: a label can only read or write rows matching its own workspace.
• Privileged database helpers run as security-definer functions in a private schema, never exposed directly to the client.
• Audio, cover art and artist images live in private buckets and are only reachable through short-lived signed URLs.
• Member streaming uses single-use magic links, device-bound sessions, a two-device cap and a 30-day expiry.
• Administrative access is least-privilege and protected by multi-factor authentication.
• Payments run through Stripe — we never see or store full card numbers.

The production database is backed up automatically every day with point-in-time recovery, and backups are encrypted and stored in the same EU region. Deleted data is purged from backups on a rolling schedule of up to 30 days. You can also export your full fan database, artist data and page content as CSV/JSON at any time — no lock-in.

Application errors are captured and reviewed, sensitive endpoints are rate-limited, and every outbound email (recipient, template, status, error) is written to an internal delivery log so failures are never silent.

Supabase (database, storage and hosting), Resend (email delivery) and Stripe (payments). Full detail, locations and transfer safeguards are in our Privacy Policy and DPA.

We secure the platform: infrastructure, encryption, isolation and access controls. You secure your workspace: use a strong unique password, only invite team members who need access, honour the consent choices your fans give you, and upload only data you have a lawful basis to hold.

Email support@loyalleague.app with "SECURITY" in the subject line. Include steps to reproduce and any proof of concept. We acknowledge reports within two working days and aim to give a remediation plan within ten. Please give us reasonable time to fix an issue before disclosing it publicly, and don't access, modify or delete other people's data while testing. We won't pursue legal action against good-faith researchers who follow this.