Our security principles
Tapelog is built on the principle that your data is yours. We've made deliberate architectural choices to minimise the attack surface and ensure that even if something went wrong on our end, your recordings would remain protected.
API keys never on device
OpenAI and Anthropic API keys are stored as Supabase Edge Function environment secrets. They never appear in the app bundle, in client code, or on your device.
Row-level security
Every database table has Postgres Row Level Security enabled. Even with a compromised anon key, it's impossible to access another user's recordings.
Private storage buckets
Audio files are stored in private Supabase Storage buckets. Files are namespaced by user ID and are only accessible via authenticated requests.
Auth via Supabase
Authentication is handled by Supabase Auth with JWT tokens. Passwords are never stored in plaintext — bcrypt hashing with appropriate work factor.
HTTPS everywhere
All communication between the app and our servers is over HTTPS/TLS. Audio files, transcripts, and API calls are all encrypted in transit.
At-rest encryption
Supabase encrypts all data at rest. Audio files in Supabase Storage are encrypted using AES-256.
What we do with your audio
When you record or upload audio, here's exactly what happens:
- The audio is uploaded directly to your private Supabase Storage bucket
- Our Edge Function reads the audio from storage using your session credentials
- The audio is sent to OpenAI Whisper for transcription over HTTPS
- The transcript is sent to Anthropic Claude for analysis over HTTPS
- Results are stored in your Supabase database with RLS
- The original audio remains in your private storage bucket
At no point does audio pass through our own servers. The Edge Function is stateless and doesn't store audio. We don't have access to your recordings.
OAuth security
Google and Apple OAuth is implemented using Supabase's OAuth flow with PKCE. We never see your Google or Apple password. Tokens are stored securely in the device's AsyncStorage and are used only to authenticate with Supabase.
Our security checklist
- ✓Row-level security on all database tables
- ✓Private Supabase Storage buckets with per-user namespacing
- ✓API keys stored as server-side Edge Function secrets
- ✓HTTPS/TLS on all network communication
- ✓At-rest encryption via Supabase (AES-256)
- ✓JWT-based authentication with short expiry
- ✓PKCE flow for OAuth (Google, Apple)
- ✓No third-party analytics that see recording content
- ✓Stateless Edge Functions — no audio retained server-side
- ✓Regular dependency audits and updates
🔍 Responsible disclosure
Found a security vulnerability? We take all reports seriously and aim to respond within 24 hours. Please don't publicly disclose issues before we've had a chance to fix them.
Report a vulnerability