Infrastructure

EU-hosted primary datastore — our production database runs in the European Economic Area (Stockholm, AWS eu-north-1 via Supabase), and application compute is pinned to the same EU region.
Encryption in transit — TLS 1.2+ on all public pages, APIs, and internal service calls.
Encryption at rest — managed encryption on database storage and object storage (Cloudflare R2).
Managed backups — automated database backups with point-in-time recovery.

Access control

Authentication via industry-standard JWT sessions; administrative access uses a separate role-gated system with explicit write-access checks on every mutation.
Row-level security on product tables; production credentials exist only in server-side code — never in client bundles.
Least-privilege internal access, limited to engineering personnel under confidentiality obligations.
Multi-tenant isolation by ownership keys enforced at the query layer — a customer's fan data is only reachable through that customer's scoped credentials.

Application security

Audit logging of sensitive operations — bulk data exports, account deletion, and administrative actions are recorded with actor and timestamp.
Rate limiting on authentication and API surfaces; export endpoints carry additional role checks and tighter limits.
Secrets management through environment isolation — no credentials in source control.
Error monitoring via Sentry, configured to exclude fan PII from error payloads.
Data minimization in analytics — product telemetry uses pseudonymous identifiers; fan contact details are not sent to analytics tooling.

Data protection & compliance

GDPR / UK GDPR / Swiss FADP — for European users and customers, we act as processor under a Data Processing Agreement incorporating EU Standard Contractual Clauses (with the UK Addendum and Swiss adaptations). Request our DPA at privacy@soundyaad.com.
NDPA 2023 — we comply with the Nigeria Data Protection Act as a registered data controller.
Sub-processor transparency — the maintained list lives at /legal/sub-processors; customers receive 30 days' advance notice of changes with a right to object.
Self-serve data rights — account holders can export all their data or delete their account from Settings → Privacy & Data; fans can unsubscribe at any time via the link in every message.
Retention limits — product telemetry purges after 30 days, email delivery logs after 90 days; customer-tier retention windows apply to fan data.

Incident response

We maintain a documented incident response runbook. For a confirmed personal-data breach we notify affected controller customers without undue delay and within 72 hours (target: 24 hours), and notify the Nigeria Data Protection Commission within 72 hours where the NDPA requires. Vulnerabilities can be reported to privacy@soundyaad.com.

For security review teams

Running a vendor assessment? Our pre-filled security questionnaire answers (SIG Lite format), DPA, and sub-processor list are available on request — email privacy@soundyaad.com with the subject "Security review".