Security.

Infrastructure.

ARK runs on managed EU-region infrastructure (Supabase / Lovable Cloud). Database, authentication and storage all sit inside the same managed platform. Application code runs on serverless edge workers.

Isolation.

Row-level security (RLS) is enabled on every table. Cross-tenant reads (team roster, shared records, program catalog) go through security-definer database functions. Never through loosened table policies. A user cannot read another user's private data.

In transit and at rest.

All traffic is served over TLS. Data at rest is encrypted by the infrastructure provider.

Authentication.

Email/password with strong-password hashing by the auth provider. Optional Google sign-in. Session tokens attached server-side; privileged operations verify the caller's identity and role before writing.

AI handling.

All AI calls are server-side only; the AI provider key never leaves the server. We do not train external models on customer data. AI-generated content is always labelled in-product and must be verified before use.

Guest mode.

The daily loop works without an account and stores data only in the visitor's browser.

Payments.

Card data is handled entirely by Stripe. We never see or store card numbers.

Deletion and export.

Every account can export all of its data as JSON from the settings panel. Deletion requests are honoured within 30 days.

Reporting a vulnerability.

Email security@shift.studio. We respond within 48 hours.

Roadmap (honest).

• SSO / SAML for Org customers. On the enterprise roadmap.
• SOC 2 Type II. On the enterprise roadmap, not yet certified.
• Region pinning for large customers. On request.