Security & GDPR
Neofir is hosted entirely in the EU. Data is stored in Frankfurt (Supabase eu-central-1, Railway EU region). The platform is built around GDPR's controller / processor distinction: you are the controller of your end-users' data; we are the processor.
Data residency
- Database — Supabase, AWS Frankfurt (eu-central-1).
- Compute (backend) — Railway, EU region.
- Dashboard — Vercel, with EU region preferred.
- Static landing & docs — Romarg (România).
- Widget CDN — Romarg (România).
- Transactional email — Resend (US + EU; we use the EU pool).
- SMS / WhatsApp — Twilio (US-headquartered but EU-stored for EU senders).
- LLM — Google Gemini. EU deployment used when available; data is not retained for training under enterprise terms.
Authentication
Dashboard auth runs through Supabase Auth. The default sign-in path is email + password with a 6-digit email code for verification (sent via Resend with Neofir branding). Google OAuth is supported. Phone OTP exists but is demoted to a secondary path.
Encryption
- In transit: TLS 1.2+ everywhere. HSTS enabled on neofir.com.
- At rest: Supabase volumes are AES-256 encrypted at the disk layer.
- OAuth tokens: Meta page access tokens are encrypted application-side with AES-256-GCM using a 32-byte
ENCRYPTION_KEY, then stored in the DB. Token rotation is supported. - Webhook signatures: HMAC-SHA256 against the provider's secret, verified before any business logic runs.
Row-level security
Every tenant table has RLS enabled with policies scoping reads and writes to the caller's organization. Cross-organization paths (rate-limit counters, platform admin actions, third-party webhook ingestion) run through privileged service code that always pins the organization id explicitly as defence in depth.
Audit log
Admin actions that affect another party are logged: organization suspend / delete, conversation export, customer data deletion, password reset on behalf of a user, takeover and return-to-agent. The log lives at /admin/audit.
Right to erasure
Org owners can delete their own org from Settings → Privacy → Delete account. The deletion is gated by slug-typed confirmation. Deletion cascades through messages, conversations, bookings, documents, chunks, embeddings, services, and resources; OAuth tokens are revoked.
Customer data (end-user) deletion can be requested by emailing privacy@neofir.com. We action within 30 days per GDPR Art. 17.
Data Processing Agreement
A DPA is available at neofir.com/dpa. The template is based on the EU Commission's standard contractual clauses and aligns with the published sub-processor list.
Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database, auth | EU (Frankfurt) |
| Railway | Backend compute | EU |
| Vercel | Dashboard hosting | EU |
| Google (Gemini) | LLM inference | Multi-region, EU preferred |
| Twilio | SMS & WhatsApp | US (EU storage for EU senders) |
| Resend | Transactional email | EU pool |
| Stripe | Payments | EU (Ireland) |
| Romarg | Static hosting | RO |
The live list, with controller / processor breakdown, is at neofir.com/sub-processors.
Incident response
Security incidents and personal-data breaches are notified to affected controllers within 72 hours per Art. 33. Email security@neofir.com to report.
Responsible disclosure
If you find a vulnerability, please email security@neofir.com with a proof of concept. We acknowledge within 24 hours and aim to triage within 72. We do not yet run a paid bounty programme.