Security and trust
Security and trust
Admin paths intercept at the edge before any application code runs. Everything the studio does is listed below, next to the one thing it does not hold.
| Practice | Verified status |
|---|---|
| Authentication & access | Edge authentication for admin surfaces via HTTP Basic Auth at the Vercel edge. Admin surfaces are gated before any content is served. Principle of least privilege across service accounts. |
| Data protection | Data minimization — only required engagement data is collected. Client data never leaves the Supabase project scoped to that engagement. Row-level security policies enforced. Transport via TLS 1.2+ and HTTPS everywhere. |
| Secrets & dependencies | API keys, credentials, and environment secrets are never committed. Secrets provisioned via Vercel; rotated on access-change events. Dependencies pinned to known versions with regular Dependabot audits. |
| Operations | Every engagement ships with runbooks, recovery procedures, and credential escrow. All client communication over encrypted channels. NDA execution for proprietary-data engagements. |
| Formal certifications | We do not currently hold SOC 2 Type II, ISO 27001, or other formal certifications. We operate as a single-operator practice with a documented continuity plan for operational-risk mitigation. |
Statement read October 10, 2026.
Contract terms that protect you
These are the same commitments written in the Terms of Service, collected here so a security reviewer does not have to hunt for them.
You own what you pay for
On full payment you own the code, documents and data products created for your engagement. Pre-existing tools stay with the studio, under a perpetual, royalty-free license to you.
Confidential by default
Client information is confidential by default, and on request a mutual NDA is signed before any proprietary information is shared.
No resale of your data
Client data is not shared with third parties except as needed to deliver the engagement, for example cloud infrastructure providers under their own privacy commitments.
Recovery documents ship with the build
Every engagement ships with runbooks, recovery procedures and credential escrow, so the system does not depend on one person’s memory.
Request flow
Admin paths intercept at the edge before any application code runs.
- 01Browser
- 02Vercel Edge CDN (SOC 2 Type II)
- 03Edge Auth (HTTP Basic)
- 04React application
- 05API routes
- 06Supabase (SOC 2 Type II, RLS)
Reporting a vulnerability
Email rs@sotoprojdev.com directly. 24-hour acknowledgment commitment.
Vulnerability reports follow a published security.txt, with a 24-hour acknowledgment commitment.