Sensitive records need layered protection.
This public overview explains the controls used without publishing details that would weaken them. It is not a guarantee that incidents can never occur.
Security baseline · 4 August 2026
Account and session security
- Supabase-managed authentication with Google OAuth or one-time email links.
- Secure cookie-based server sessions and protected application routes.
- No Google password is received or stored by Beyond PMDD.
- Private portal pages are blocked from search-engine indexing and are served with no-store cache controls.
Database isolation
- Row Level Security is enabled on all application tables.
- Tracker records are scoped to the authenticated owner’s user ID.
- Partners cannot directly query tracker entries, private notes or safety responses.
- Partner access uses curated snapshots and category-specific permissions.
- Privileged functions validate authentication and connection ownership.
File protection
- The private file bucket is not public.
- Storage rules require files to be inside the authenticated user’s own user-ID folder.
- File type and size limits are enforced at the storage layer.
- Future clinician or partner sharing must use explicit, short-lived access rather than public file URLs.
Application controls
- Strict request validation, body-size limits and same-origin checks for state-changing API requests.
- Hashed, random, expiring and single-use partner invitation tokens.
- Security headers including content-type protection, frame blocking, restrictive browser permissions and Content Security Policy.
- Generic public error messages to reduce internal information leakage.
Responsible disclosure
Security concerns should be reported privately to [SECURITY EMAIL]. Do not include real user health records in an initial report. The response and safe-harbour policy is [RESPONSIBLE DISCLOSURE POLICY].
PLACEHOLDER — replace the security contact and publish a responsible-disclosure process before launch.
Ongoing work
Before large-scale public use, the operator should enable leaked-password protection, require MFA for administrator accounts, configure monitoring and incident response, review backups and recovery, patch dependencies, perform access reviews and commission an independent penetration test.