Where does our data live, how is it encrypted, and who can technically read it?

The full executive answer

Your data lives in a Supabase Postgres cluster in Tokyo — on AWS infrastructure — encrypted in transit with TLS and at rest by the platform. I will flag residency honestly before you ask: Tokyo is the only provisioned region today; EU and India cells exist in configuration and are unprovisioned. If your data-residency policy requires EU, that is a provisioning milestone we would tie to your contract, not a re-architecture.

For the most sensitive fields we go beyond disk encryption with application-level field encryption: AES-256-GCM — an authenticated encryption standard, meaning the ciphertext is tamper-evident — under envelope encryption with AWS KMS. In plain terms: each write gets its own data key generated by Amazon's key management service; the master key never leaves KMS hardware; and the plaintext key material is never persisted anywhere. Even someone with a copy of the database cannot read those fields without also compromising the key service. Key provider is swappable by configuration, which is the groundwork for customer-managed keys later.

Who can technically read your data: access is layered — row-level security in the database means even our own application code cannot cross tenant boundaries; service-role access for back-office jobs is server-side only; and privileged access leaves entries in the append-only audit log. Personal data is additionally redacted before any text is sent to an AI model, and our logger masks PII by default. That is defence in depth per OWASP ASVS and the ISO 27001 cryptography control family — with the honest caveat that ISO certification itself is roadmap, not held.