Security

SoleOS holds credentials to your revenue and analytics accounts, so this page errs on the side of specifics: what we store, how it’s protected, what access we ask for, and — just as important — what security work we haven’t done yet.

Credentials

Every API key, OAuth token, and service-account file you give SoleOS is stored encrypted in Supabase Vault. Application code cannot read the Vault directly: secrets go in and out only through database functions that are executable by our server role alone — never from a browser, never through the public API surface. Credentials are never written to logs and are never displayed again after entry. Server routes strip secret fields before responding, and disconnecting a provider stops all collection immediately. Connections that use OAuth refresh their own tokens; expired or revoked credentials mark the connection as failing and we email you rather than silently showing stale numbers.

Access scopes

We request the narrowest access each provider offers: Google Analytics and Search Console use Google’s read-only scopes, RevenueCat access is limited to three enumerated read scopes, PostHog is query access to the projects you pick, Google Play is report-file reads by a service account you can remove at any time. The one exception is Stripe, which currently issues read-write OAuth to new Connect platforms: SoleOS only ever calls read endpoints, and the full per-provider breakdown is on the Connectors page.

Tenant isolation

Every table in the database has row-level security enabled, keyed on workspace membership. Reads from the signed-in app go through those policies; the tables that hold connection records and notification logs have no client-readable policies at all — they are reachable only through server code that scopes every query to your workspace.

Signing in

SoleOS is passwordless: magic-link email or Google sign-in (OAuth with PKCE). There is no password to phish, reuse, or leak. Sessions are cookie-based with short-lived tokens and refresh rotation.

Infrastructure

SoleOS runs on Vercel (hosting) and Supabase (database, authentication, secret storage) — both SOC 2-audited providers; those certifications are theirs, not ours, and we say so deliberately. All traffic is TLS; the soleos.app domain sits on the .app TLD, which browsers enforce HTTPS-only. Error monitoring (Sentry) runs with personally-identifying data collection disabled.

AI and your data

The AI insights feature sends aggregated project metrics only — totals, deltas, and event counts with your project names. It never receives credentials, raw events, or your customers’ identities, and our AI provider (Anthropic) does not train models on API data. The AI writes insights; it cannot take any action on your accounts.

What we don’t have yet

Honesty over theater: SoleOS is an early-access product run by a small team. We do not yet hold our own SOC 2 or ISO 27001 certification, and an independent penetration test is planned but has not happened yet. We publish this page so you can judge the actual architecture instead of a badge — and we’ll update it as each of those milestones lands.

Reporting a vulnerability

Found something? Email support@soleos.app with “SECURITY” in the subject. We acknowledge reports within 72 hours, won’t take legal action against good-faith research that respects user data and service availability, and will credit you in the changelog if you want. We don’t run a paid bounty program yet. Machine-readable details: /.well-known/security.txt.

If something goes wrong

If we ever have a security incident affecting your data, we will email affected workspaces within 72 hours of confirming it, with what happened, what was exposed, and what we’ve done — including credential rotation steps where relevant.