Where it runs
Our platform runs on Google Cloud via Firebase App Hosting, in the us-central1 region. Traffic is served over TLS, and data is encrypted at rest by the platform.
Database access
Client data lives in Cloud Firestore behind declarative security rules that are enforced server-side, not in the browser. A request that a rule does not permit is refused by the database itself.
Authentication
Portal and administrative access is authenticated through Firebase Authentication. Sessions are verified server-side on every privileged request.
Separation of surfaces
The client portal runs as its own isolated deployment. Administrative routes are blocked at the edge on that deployment, so a client-facing host cannot reach staff tooling even if a URL is guessed.
Who else touches the data.
The third parties involved in running this platform. If you need this list as part of a vendor review, ask and we will send it in writing.
| Provider | Purpose | Region |
|---|---|---|
| Google Cloud / Firebase | Hosting, database, authentication | us-central1 |
| Microsoft 365 (Graph API) | Transactional and contact email delivery | Microsoft-managed |
| Google (Gemini) | Powers the website assistant | Google-managed |
Reporting a vulnerability
If you believe you have found a security issue in anything we run, contact us directly and we will respond. Please give us a reasonable window to investigate and fix before disclosing publicly.
Report an issueRunning a vendor review?
Send us your security questionnaire. We would rather answer it directly than have you guess from a web page.