Security

Last updated: August 2026

Friendly holds your business's operational data and your customers' records, so security is a build requirement, not an afterthought. Here is plainly how that data is protected, and how to reach us if you find a problem.

Data protection

• Encrypted in transit and at rest. All traffic is served over HTTPS with HSTS, and stored data is encrypted at rest.
• Tenant isolation at the database level. Friendly is multi-tenant with row-level security scoped to your company, so one business can never read another's records.
• Least-privilege access. Credentials are stored in a secured environment, access is limited to what each role needs, and secrets are never committed to source.

Infrastructure

Authentication, database, and hosting run on Supabase; payments are handled by Stripe, which stores card data (we never store full card numbers). The public site enforces a strict content-security-policy and the standard set of security response headers.

Responsible disclosure

If you believe you've found a security vulnerability, email hello@hifriendly.app with the details and steps to reproduce. We investigate every report and will not pursue legal action against good-faith research that avoids privacy violations, data destruction, and service disruption. A machine-readable contact is published at /.well-known/security.txt.