Security
How we protect your data · Changelogger
Infrastructure
Changelogger runs on Vercel (hosting) and Supabase (database and authentication). Both providers use AWS infrastructure with SOC 2 Type II compliance. All data is stored in the United States.
Data in transit
All connections to Changelogger use TLS 1.2 or higher. Webhook payloads from GitHub are verified using HMAC-SHA256 signatures before processing — we reject any request that does not pass signature verification.
Data at rest
Your database is encrypted at rest by Supabase. Row-Level Security (RLS) policies are enforced at the database level on every table — even if application code has a bug, the database enforces access controls independently.
Authentication
Authentication is handled by Supabase Auth using secure, short-lived JWTs. We support email magic links (passwordless). Session tokens are stored in secure, HttpOnly cookies.
Integrations
GitHub webhook secrets are stored encrypted and never exposed in the UI. Slack bot tokens are scoped to the minimum permissions needed (post messages, read channel list). You can revoke either integration from your workspace admin console at any time.
Responsible disclosure
If you discover a security vulnerability, please report it privately to security@changelogger.com. We will acknowledge your report within 48 hours and work with you on a fix before any public disclosure. We do not pursue legal action against good-faith security researchers.