Security

Hosting & infrastructure

HiveMasterPro's production database, authentication, file storage, and Edge Functions run on Supabase in US data centers. The web marketing site and Edge serverless functions are deployed on Vercel. Edge protection, bot detection, and CAPTCHA challenges run on Cloudflare. All traffic is served over TLS 1.2+ with HSTS.

Encryption

• Data in transit: TLS 1.2+ end-to-end on every request
• Data at rest: AES-256 on Supabase Postgres and Storage buckets
• Secrets & API keys: stored in Vercel and Supabase encrypted environment stores; never committed to source control
• Bring-your-own AI keys: stored encrypted at the user level and only decrypted in-memory at the moment of an outbound provider call

Authentication & access

• Email + password authentication, with optional TOTP-based two-factor authentication for every account
• Session tokens are short-lived JWTs with automatic refresh; revocation is supported
• Server-side Row Level Security (RLS) on every Postgres table; all 38 team-role permissions are enforced server-side, not in the client
• Audit logs for staff onboarding, permission changes, lot recall actions, and data exports

Subprocessors & data flow

For the complete list of third-party subprocessors (hosting, payments, AI, maps, weather, telemetry, and public open data), see the Privacy Policy § 4. Enterprise customers can request the full Data Processing Addendum.

AI photo analysis and model improvement. Most inspection photos are analyzed and discarded. A small subset of uncertain or disputed detections (frame photos and Mite Check wash samples) is retained by Roboflow, acting as our service provider, to train future versions of HiveMasterPro's own detection models. Retained images carry no account, hive, or location identifiers. Details, limits, and the deletion path are in Privacy Policy § 4.3a.

Vulnerability disclosure

We welcome coordinated disclosure of security issues. Please email security@hivemasterpro.com with a description, reproduction steps, and any proof-of-concept materials. Acknowledgement within 2 business days; first response within 5 business days.

The machine-readable disclosure policy is published per RFC 9116 at /.well-known/security.txt.

Incident response

If a security incident affects your account or your data, we will notify affected customers as soon as we have a verified scope, and will follow applicable breach-notification laws (GDPR, CCPA, PIPEDA, and US state laws). Status updates are emailed to account owners.

Backup & data portability

Supabase Postgres is backed up automatically with point-in-time recovery. Customers can request a JSON snapshot of their account at any time and can export inspections, treatments, harvests, ELAP PDFs/CSVs, hive count CSVs, and CFIA-aligned movement records as a portable bundle. See the Terms of Service § 8.