How your information is protected.

Authentication

Accounts are authenticated through Supabase Auth. You can sign in with an email address and password, or with Google. Passwords are never stored by us in readable form — Supabase stores a salted hash, and we never see the original. Sessions use signed tokens, and password reset links are single-use and time-limited.

Every password field in AnPath includes a show/hide control so you can confirm what you typed rather than guessing — a small thing that measurably reduces lockouts.

Encryption

• In transit: all traffic between your browser and AnPath is encrypted with HTTPS/TLS. The application is served over HTTPS only.
• At rest: the database and file storage are encrypted at rest by our infrastructure provider.

To be precise about what this does not mean: AnPath is not end-to-end encrypted. Your data is encrypted in transit and at rest, but it is not encrypted with a key only you hold, because the service has to read your records to display them, search them, and generate reminders. We would rather say that plainly than imply a stronger guarantee than exists.

Access control

Authorization is enforced in the database, not just in the interface. Every table holding estate data carries row-level security policies tied to the signed-in user's identity and their membership in a given estate. A request for records you are not entitled to returns nothing — regardless of what the browser asks for.

Role-based permissions for collaborators

When you invite someone to your estate, you assign a role, and that role determines what they can read and change. Permissions are checked server-side on every request. When a role is not permitted to reach an area of the app, the user sees an explicit access-denied state rather than a partial view. Removing a collaborator revokes their access to your estate going forward.

Activity log

Changes to your estate are recorded in an activity log showing who changed what and when, with the ability to review and undo. Account lifecycle events — deactivation and deletion — are logged as well. This is a security feature as much as a convenience one: it means unexpected changes are visible to you.

Your control over your data

• Export your records to CSV at any time.
• Deactivate your account reversibly, which suspends access while retaining your data.
• Delete your account irreversibly through a multi-step confirmation in Settings, which removes your account and associated estate records and files. You are offered an export first.

See the Privacy Policy for retention details, including how backups age out.

Infrastructure

AnPath runs on managed cloud infrastructure with a managed PostgreSQL database and object storage provided by Supabase. Server-side secrets and API keys are held in the platform's secret storage and are never shipped to the browser. Payment card details are handled by a third-party payment processor; we do not store full card numbers.

What we do not claim

We think an inflated security page is worse than a modest, accurate one, so to be explicit: AnPath does not currently hold a SOC 2 report, ISO 27001 certification, or any comparable third-party security certification, and we do not claim HIPAA, PCI, or GDPR "compliance" as a certified status. We have not undergone an independent penetration test that we can point you to. We do not offer end-to-end encryption. If any of that changes, this page will say so, with a date.

Shared responsibility

Some of this only works if we both do our part.

• AnPath's part: operate the platform securely, enforce access control at the database level, encrypt traffic and storage, keep dependencies current, and tell you honestly what we do and don't have.
• Your part: use a strong, unique password, protect the email account tied to your login, invite only people you trust and give them the narrowest role that works, remove access when circumstances change, and keep originals of critical legal documents somewhere safe outside any app.

Reporting a security concern

If you believe you have found a vulnerability, or you think an account has been accessed without authorization, email support@anpath.app with the subject line "Security". Include enough detail to reproduce the issue.

We aim to acknowledge security reports within one business day. Please give us a reasonable opportunity to investigate and fix an issue before disclosing it publicly, and please do not access, modify, or delete other people's data while testing. We will not pursue action against good-faith researchers who follow those two principles.