Security

Sign-in is handled by Supabase Auth. You can sign in with email and password or with Google. Passwords are hashed by Supabase; we never see them.

Sessions are short-lived JWTs that refresh in the background; you can sign out from any device by signing out of your active session.

The database enforces row-level security on every table holding agency or client data. An agency owner can see their own agency's data; team members can see and edit project content; clients can see only the projects and files explicitly shared with them. These rules are enforced at the database layer, not just in the UI.

Admin actions on Filoow's side require a separate role stored in a dedicated user-roles table — agency accounts cannot escalate themselves to admin.

All traffic between your browser and Filoow uses TLS. Database storage and file storage are encrypted at rest by Supabase. Backups are managed by Supabase on the same encryption guarantees.

Card details are entered directly into a Stripe-hosted checkout form and never touch Filoow's servers. We store only Stripe identifiers (customer id, subscription id) needed to look up your subscription.

We use the following providers to operate Filoow:

• Supabase — database, authentication, file storage (EU region).
• Stripe — payments and subscription management.
• Resend — transactional email (invites, notifications).
• PostHog — anonymised product analytics.
• Cloudflare / Lovable — application hosting and edge runtime.

If you think you've found a security issue, please email security@filoow.com with a description and reproduction steps. We'll acknowledge within 2 business days and keep you updated on remediation.

Filoow is not currently certified under SOC 2, ISO 27001, HIPAA, or PCI. If your use case requires any of these, please contact us before subscribing.