Supabase Authentication with JWT sessions
Secure password authentication, encrypted session cookies, session expiration, secure password reset workflows, and email verification.
Security at BevGenie.
At ConsumerIQ, protecting customer data is fundamental to how we build and operate BevGenie. Security is integrated throughout our software development lifecycle, cloud infrastructure, and operational processes.
Although no system can guarantee absolute security, we employ industry-standard administrative, technical, and organizational safeguards designed to protect customer information.
At a glance
- Encryption
- TLS for all communications between users and BevGenie; provider-managed encryption at rest.
- Authentication
- Supabase Authentication with secure JWT-based session management.
- Isolation
- Customer information is logically isolated and never intentionally exposed to other organizations.
- Access
- Least-privilege principles; administrative access limited and protected by authentication controls.
Secure infrastructure
Hosted on modern cloud infrastructure.
BevGenie is hosted on modern cloud infrastructure selected for reliability, scalability, and security. Each provider performs only the functions necessary to deliver the Service.
| Provider | Purpose |
|---|---|
| Vercel | Application hosting and deployment |
| Supabase | Authentication, PostgreSQL database, vector storage |
| Amazon S3 | Customer file ingestion and secure storage |
| Anthropic | AI inference |
| Voyage AI | Text embeddings supporting semantic search (when enabled) |
| Stripe | Billing and subscription processing |
| Resend | Transactional email delivery |
| Google Analytics | Website analytics (when enabled) |
Our primary infrastructure providers currently include the above. This list is reviewed as the platform evolves.
Controls
What is in place
Grouped the way a security reviewer reads them.
In transit and at rest
All communications between users and BevGenie are encrypted using TLS. Customer information stored within supported cloud providers is encrypted at rest using provider-managed encryption technologies.
Logically isolated
Customer Content is never intentionally exposed to other organizations using BevGenie. Access is limited to authorized personnel with a legitimate operational need.
Least privilege
ConsumerIQ follows least-privilege principles. Administrative access is limited and protected through authentication controls.
Continuous
We monitor platform health, reliability, and security events — authentication events, application errors, infrastructure availability, and operational logs.
Reviewed, not assumed
Critical application data is backed up according to our operational procedures, and recovery processes are periodically reviewed to help ensure business continuity. Security issues are prioritized according to severity, and we regularly update infrastructure and dependencies to address known vulnerabilities.
In the product itself
What a reviewer can check inside BevGenie.
The controls above describe the platform. These are the ones that govern what the application does with a customer's data every time somebody asks a question.
Organization isolation at the database layer
Row-level security policies filter records by organization inside the database, rather than relying on the application to remember which tenant is asking. One organization cannot read another organization's conversations, reports, exports, or data connections.
Role-based access, granted per data set
Two roles, Admin and Member, separate who manages the organization from who works inside it. Access to a specific data mart is granted to a person or a team at the level they need, and revoked in one place.
Queries against customer systems are read-only
Generated SQL runs through a database function that accepts reads only, rejects statements that would modify data, restricts the schemas in scope, and applies a statement timeout and a row cap. BevGenie reads a connected system and cannot write to it.
Connection credentials are encrypted
Database and model credentials are encrypted with AES-256-GCM before storage and decrypted only to serve a request from the organization that owns them.
Uploaded files are validated before they are stored
Uploads are checked by file signature rather than by extension and held to a size limit. They are also checked for personal data, which is flagged rather than removed.
Shared files stay in private storage
Exports and generated documents live in private storage. A share link is authorized at the moment the file is opened, so removing access takes effect immediately rather than when a link expires.
Responsible disclosure
Found something? Tell us first.
If you believe you have identified a security vulnerability, please contact us directly. Please do not publicly disclose security vulnerabilities until we have had an opportunity to investigate and address them.
security@consumeriq.ai
Include enough detail for us to reproduce the issue. Please do not include customer data in your report.
Bring your security reviewer to the first call.
We would rather answer the hard questions early than late.