Security Overview

1. Authentication

Access to EstateWise requires authenticated login. Authentication is managed through Supabase Auth, which provides secure email-and-password authentication with session token management. Sessions are maintained using short-lived tokens that are refreshed automatically. Unauthenticated requests are rejected.

2. Role-based access control

EstateWise implements role-based access control at both the application and database levels.

Within a firm account, different roles (such as administrator and team member) have different capabilities. Administrators may invite team members, manage firm settings, and control access to estates. Team members can access only the estates they are assigned to.

Access permissions are enforced programmatically and are not reliant solely on the user interface.

3. Row-level security and storage policies

Database access is enforced through Postgres row-level security (RLS) policies. These policies are evaluated at the database level, meaning that even a compromised application layer cannot bypass them to retrieve data belonging to another firm or user. Storage bucket access is similarly controlled through storage policies, preventing direct access to uploaded documents without proper authentication and authorisation.

4. Document access and signed URLs

Uploaded and generated documents are not publicly accessible. When an authorised user requests access to a document, the platform generates a short-lived signed URL. This URL expires after a brief period and cannot be shared to grant persistent access. Document access events are recorded in the audit log.

5. Audit logging

EstateWise maintains an audit log of significant platform actions, including document views, downloads, and key estate workflow events. Audit records capture the acting user, the action performed, and a timestamp. Audit logs are used for internal security monitoring and accountability.

6. Hosting and infrastructure

The EstateWise application is hosted on Vercel, a cloud application platform with built-in DDoS mitigation and global distribution. The database, authentication, and file storage are provided by Supabase, which operates on Amazon Web Services (AWS). Both Vercel and Supabase maintain their own security programmes and certifications. EstateWise leverages these platforms' underlying infrastructure security.

7. Data in transit and at rest

All data transmitted between your browser and the EstateWise platform is encrypted using TLS (Transport Layer Security). Data stored on Supabase infrastructure is protected by infrastructure-level encryption at rest. EstateWise does not operate its own physical servers.

8. Field-level encryption for sensitive data

EstateWise is progressively implementing application-level, field-level encryption for structured sensitive fields such as identity numbers. This is an active area of development. Full field-level encryption coverage across all sensitive structured fields is not yet complete. We will update this page as implementation progresses.

9. Backups and resilience

Supabase performs automated database backups as part of the platform service. Exact backup frequency, retention periods, and point-in-time recovery capability depend on the service tier in use. EstateWise does not operate independent backup infrastructure at this stage. Firms are advised to export critical records as part of their own business continuity practices.

10. User responsibilities

Security is a shared responsibility. Users and firms are responsible for:

— Using strong, unique passwords for EstateWise accounts.

— Not sharing account credentials with colleagues — each team member should have their own login.

— Revoking access promptly when a team member leaves the firm or changes roles.

— Reporting suspected account compromise or suspicious activity to info@estatewise.info immediately.

— Ensuring that devices used to access EstateWise are adequately protected.

11. Reporting security concerns

If you discover a potential security vulnerability in the EstateWise platform, please contact us responsibly at info@estatewise.info before disclosing it publicly. We take security reports seriously and will respond promptly.