Security & Data Protection

Defined terms carry the meanings given in BeDeeper's shared legal definitions unless expressly redefined here.

---

In plain language

BeDeeper takes protection of your account and your writing seriously. This document describes what BeDeeper does today — encryption, authentication, session management, responsible disclosure, and incident response — and what BeDeeper asks of you in return.

Related documents:

• Privacy generally: Privacy Policy
• Cookies actually set: Cookie Policy
• What leaves the sanctuary when The Lantern responds: AI Transparency

---

1. Encryption in transit

All traffic between your device and BeDeeper is served over HTTPS with modern TLS. BeDeeper does not offer an unencrypted route to the sanctuary. Traffic to BeDeeper's subprocessors (Supabase, Stripe, OpenAI, Resend, Vercel, Google/Apple OAuth) is likewise over encrypted channels provided by those subprocessors.

2. Encryption at rest

Member data is stored in the databases and file storage operated by BeDeeper's infrastructure subprocessors — primarily Supabase for the database and file storage, and Vercel for hosting artifacts. Those subprocessors provide at-rest encryption for the storage layers BeDeeper uses.

BeDeeper does not currently apply an additional application-layer encryption pass to the content of Living Journal entries, Lantern conversations, or Compass content. Row-level security separates one member's data from another's at the database level. Where BeDeeper introduces application-layer encryption for a specific data class, this document is updated first.

3. Authentication

Sign-in methods:

• Email and password. Passwords must be at least eight (8) characters and must contain at least one uppercase letter and at least one number. Passwords are stored by Supabase Auth as salted hashes; BeDeeper never sees your plaintext password.
• Google OAuth.
• Apple OAuth.

Magic-link login, passkeys, and enterprise SSO are not offered at this time.

4. Multi-factor authentication

BeDeeper supports optional time-based one-time-password (TOTP) multi-factor authentication:

• You may enroll a TOTP factor in Settings.
• Recovery codes are generated on enrollment. BeDeeper stores only a hashed form of each recovery code.
• You may mark a device as "trusted" to reduce prompts on that device for a limited period. Trusted devices are tracked in a table and matched to a signed cookie (see Cookie Policy, bedeeper_trusted_device).
• A short-lived signed grant cookie holds your MFA state within a session (see Cookie Policy, bedeeper_mfa_grant).

MFA is currently optional. BeDeeper may make MFA required for some categories of account (for example, administrators). Changes to MFA requirements will be described here first.

5. Session management

Sessions are held by Supabase Auth. Session cookies are refreshed on activity by the middleware. You may end all other sessions from Settings ("Sign out of all other devices"). Logging out clears BeDeeper's authentication and MFA cookies.

Session-length defaults are the defaults configured for BeDeeper's Supabase project. Changing them will be described here first.

6. Application security controls

BeDeeper applies the following controls at the application layer:

• HTTP security headers — X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, and a Permissions-Policy disabling access to sensors, geolocation, and payment APIs the sanctuary does not need.
• Row-level security (RLS) on member-facing tables so that only the owning member (and BeDeeper administrative queries subject to internal controls) may read a row.
• Signed short-lived cookies for MFA grant and trusted-device markers.
• Redaction of derived commitment data where a redaction pass exists for content BeDeeper synthesizes from member writing (this does not encrypt the underlying content).

7. Access inside BeDeeper

Access to member data by BeDeeper's team is restricted:

• Row-level security enforces separation of member data at the database.
• Administrative access is limited to the purposes described in Privacy Policy (moderation of a specific report, abuse response, diagnostics of a specific incident, legal obligations).
• Founder and administrative account holders are subject to the ordinary sign-in controls above, and to internal expectations of restraint.

Any current administrative access surface not fully constrained by tooling is identified in BeDeeper's legal consistency review for tightening.

8. Subprocessors

The subprocessors BeDeeper relies on to keep the sanctuary running are listed in BeDeeper's Legal Foundation. Each is bound by its own terms with BeDeeper. Where a subprocessor is added, replaced, or removed, BeDeeper's Legal Foundation is updated first and this document follows.

9. Backups

Member data is included in BeDeeper's operational backups so the sanctuary can recover from failure. Backups are encrypted by BeDeeper's infrastructure subprocessors. Retention of deleted content in backups is described in Account Termination.

Backups are used only to restore the sanctuary. They are not surfaced back to members or staff except in a documented incident-recovery scenario.

10. Responsible disclosure

BeDeeper welcomes reports from security researchers.

Reporting. If you believe you have found a vulnerability affecting BeDeeper, please write to security@bedeeper.com. Please:

• Include a clear description, steps to reproduce, and the affected surface.
• Give BeDeeper reasonable time to investigate and remediate before public disclosure.
• Do not access, modify, or delete data that is not yours.
• Do not degrade the sanctuary for other members.
• Avoid social engineering, phishing, or physical attacks against BeDeeper or its subprocessors.

Our commitment. Where a report is made in good faith and follows the guidance above, BeDeeper will not pursue legal action against the researcher for the disclosure itself. BeDeeper acknowledges receipt within a reasonable time and communicates on remediation. BeDeeper does not currently operate a paid bug-bounty program.

Out of scope. Attacks against BeDeeper's subprocessors' infrastructure (Supabase, Stripe, OpenAI, Resend, Vercel) should be reported to those subprocessors directly, in line with their own disclosure programs.

11. Incident response

If BeDeeper becomes aware of a security incident that meaningfully affects member data:

• BeDeeper will investigate, contain, and remediate as quickly as reasonably practicable, in coordination with the affected subprocessor where relevant.
• BeDeeper will notify affected members promptly, with the substance of what happened, what BeDeeper has done, and what members can do.
• BeDeeper will notify supervisory authorities where required by applicable law within the timeframes those authorities require.
• BeDeeper will publish a summary where appropriate to inform members and the wider community.

Nothing in this section limits legal obligations that apply to specific incidents.

12. Member responsibilities

Please help BeDeeper keep your account safe:

• Password hygiene. Use a strong, unique password. A password manager makes this easy.
• MFA. Enrolling a TOTP factor is one of the most effective ways to protect your account.
• Device care. Sign out of shared devices. Do not mark a device you do not control as trusted.
• Phishing. BeDeeper will never ask you to share your password or recovery codes. Legitimate BeDeeper support replies always come from BeDeeper contact aliases listed in BeDeeper's Legal Foundation (for example, support@, billing@, privacy@, security@) — never from a personal address, and never from a domain other than the one shown in BeDeeper's Legal Foundation.
• Report anything unusual. If you notice an unexpected sign-in, a password reset you did not initiate, or something else that feels off, please write to security@bedeeper.com.

13. Not a warranty

The controls in this document describe BeDeeper's current practices. They are not a warranty that BeDeeper is invulnerable. To the fullest extent permitted by law, the disclaimers and limitations in Terms of Service apply.

14. Changes

Substantive changes to this document follow the notification convention in Terms of Service and the effective-date convention in BeDeeper's Legal Foundation. Introducing or removing a control affecting member data is treated as substantive.

15. Contact

Security concerns and disclosure reports go to security@bedeeper.com. General questions may be sent to hello@bedeeper.com.