Security

Infrastructure

SmoothProfit is built on Supabase (managed PostgreSQL, Auth, and Storage). Data is encrypted in transit (TLS) and at rest. Every table that holds tenant data is protected by Row Level Security policies as a defense-in-depth measure, in addition to application-layer tenancy checks.

Payments

Affiliate payouts are disbursed through Stripe Connect. We never handle or store raw bank account or card numbers — those are held exclusively by Stripe, a PCI Level 1 Service Provider.

Access controls

• Agency staff can only read/write data belonging to their own agency.
• Affiliates can only read/write their own affiliate record and its related data.
• Server-to-server API access requires a per-program API key, hashed at rest (SHA-256) — the raw key is shown once and never stored in plaintext.
• Inbound webhooks (Stripe, WooCommerce) are authenticated via signature verification or API key.

Responsible disclosure

If you believe you've found a security vulnerability, please report it to security@smoothprofit.app rather than filing a public issue. We'll acknowledge reports promptly and keep you updated as we investigate.