Workspaces are kept apart
Every record in AROOOXA belongs to one workspace. The database itself enforces this with row-level security policies, so a query can only ever return rows from workspaces the signed-in person belongs to. The application checks the same rules again on the server before it reads or changes anything.
Roles and permissions
Workspace owners decide what each role can see and do. A designer can run projects without seeing invoices, for example. The same permissions apply everywhere, including the AROOOXA MCP server: an AI assistant connected to your workspace acts as you and can only do what your role allows.
Signing in
Accounts are handled by Supabase Auth. You can sign in with email and password or with Google. We never see or store your password in readable form. AI assistants connect through OAuth, so you approve access in your browser and never paste a password or key into a chat.
Client links
Proposals, invoices, forms, booking pages and shared folders reach your clients as links, so they never need an account. Those links are not listed anywhere and are blocked from search engines.
- Shared folders can have a password. Passwords are stored only as a salted scrypt hash.
- File downloads use short-lived signed links, so a copied download link stops working after a while.
- You can see when each link is opened, and you can pause or remove a share at any time.
Data in transit and at rest
All traffic to AROOOXA, the app and every client link uses HTTPS. Workspace data is stored with Supabase (PostgreSQL), and files in the file manager are stored with Backblaze B2. Both are established infrastructure providers that encrypt stored data on their side.
Who processes data for us
We use a small number of service providers to run AROOOXA, listed in the privacy policy. Each one only receives what it needs to do its job.
Your data is yours
You own what you put into AROOOXA. You can export your clients and companies at any time, and you can delete your account from its settings. We never sell workspace data or use it to advertise to you or your clients.
Reporting a security issue
If you think you have found a security problem, email [email protected] with the subject "Security report". Include what you found and how to reproduce it. Please give us a reasonable time to fix it before telling anyone else, and do not access or change other people's data while testing.
We reply to every report and will tell you when it is fixed.