Security

Approach

Security is built into Centrely’s architecture rather than added on afterwards. Because the Service handles student, staff and payment records across multiple branches, access is enforced at the data layer — not just in the UI. This page describes the measures in place and is written honestly about the limits of a personal project.

Access control

• Row-level security (RLS) — authorisation is enforced in the database itself. Every query is scoped so users only ever see rows they are permitted to, down to the individual branch and record.
• Role-based access— permissions are tied to defined roles, so staff at one branch cannot reach another branch’s data.
• Authentication — handled by Supabase Auth. Passwords are never stored in plain text.

Data protection

• Encryption in transit — all traffic is served over HTTPS/TLS.
• Encryption at rest — data is stored on managed infrastructure that encrypts data at rest.
• Least privilege — application credentials are scoped to only what each operation needs.

Infrastructure

Centrely runs on established managed providers rather than self-managed servers:

• Supabase — managed Postgres database, authentication and storage.
• Vercel — application hosting, TLS and content delivery.

Each provider maintains its own security and compliance programme. See the Privacy Policy for how these providers act as sub-processors.

Application security

• Type-safe end to end — database types are generated from the live schema, reducing a class of data-handling bugs.
• Money math and access-control logic are unit-tested as pure functions, separate from request handling.
• Dependencies are kept reasonably up to date to pick up security fixes.

Honest limitations

Centrely is a personal project operated by one person. There is no dedicated security team, no formal certification (such as SOC 2 or ISO 27001), and no guaranteed incident-response time. No system is completely secure. Please weigh this before entering highly sensitive data, and keep your own backups of anything important.

Reporting a vulnerability

If you find a security issue, please report it responsibly. Email sudwiptokmondal@gmail.com with steps to reproduce and any relevant details. Please do not publicly disclose the issue until it has had a reasonable chance to be fixed. I appreciate good-faith reports and will acknowledge them as soon as I can.

Contact

Security questions? Email sudwiptokmondal@gmail.com.