Security

Mission Growth Limited is an early-stage company. We do not yet hold our own SOC 2 Type II certification, ISO 27001 certification, or a formal penetration-test report. We are stating this clearly so you can make an informed decision.

What we have done is build on infrastructure providers that do hold these certifications (see the Vendor security inheritance section), implement technical controls appropriate to our architecture, and document our practices honestly on this page.

We are working toward independent certification. As a first public signal, we plan to submit a self-assessment to the CSA STAR Registry. We will update this page as our certification status changes.

At rest: All customer data stored in our database is encrypted at rest using AES-256. This encryption is applied at the disk layer by Supabase on all storage, database volumes, and backups. We do not apply additional row-level encryption (pgcrypto) at the application layer.

In transit: All connections between your browser and our servers are encrypted using TLS 1.3. TLS termination is handled by Caddy (our reverse proxy on the API server) and by Vercel's edge network for the frontend. Connections from our API server to Supabase are also TLS-encrypted.

Secrets management: Sensitive credentials (API keys, tokens, database connection strings) are managed as environment variables. They are not stored in source code or version control.

Customer authentication: Account access is managed through Supabase Auth. Passwords are hashed using bcrypt and are never stored in plaintext. Sessions are issued as short-lived JWT tokens. Multi-factor authentication (MFA) is available for customer accounts.

Internal access: Our engineering team accesses production infrastructure through role-based access controls. Access to the production database is restricted and logged. We do not maintain persistent shell access to customer data.

API security: All API endpoints require a valid JWT issued by Supabase Auth. Requests without a valid token are rejected at the route level before any data access occurs.

Mission Growth is a multi-tenant platform. Every customer's data is scoped to their unique workspace identifier (space_id).

Database layer: We enforce Row-Level Security (RLS) on all tenant-scoped tables in PostgreSQL. RLS policies prevent any database query from returning rows that belong to a different workspace, even if an application-layer error were to occur.

Application layer: Every query in the application includes a space_id filter enforced at the service level. These two layers of isolation operate independently so that a failure in one layer does not expose another customer's data.

No customer can access another customer's data through the API, the UI, or direct database access.

API server: Our backend runs on a Hetzner CPX32 server located in Germany. Hetzner's German data centres hold ISO 27001:2022 certification (valid through September 2028, audited by SOCOTEC Certification). Hetzner provides network-level DDoS mitigation on all CPX instances.

Database: Customer data is stored in Supabase (PostgreSQL with pgvector), deployed in the eu-central-1 region (Frankfurt, Germany). Supabase is SOC 2 Type II compliant.

Frontend: The web application is served via Vercel's global edge network. Vercel holds SOC 2 Type II and ISO 27001:2013 certifications and provides edge-layer DDoS mitigation.

Reverse proxy: Caddy handles TLS termination, certificate rotation, and reverse-proxying to the API server. TLS certificates are issued automatically via Let's Encrypt.

These certifications belong to the respective vendors. Mission Growth Limited inherits the benefit of their infrastructure security; we do not hold these certifications ourselves.

Database backups: Supabase performs daily automated backups of the production database. Backups are encrypted at rest using AES-256 and retained for 7 days.

Schema versioning: All database schema changes are applied through versioned migration files stored in version control. This allows us to reconstruct the database schema at any point in its history.

Recovery procedures: Recovery procedures are documented internally and reviewed by engineering. In the event of data loss, we can restore from the most recent daily backup.

We do not currently use Point-in-Time Recovery (PITR). Our recovery objective is based on the daily backup cadence.

Our core infrastructure providers maintain their own independently audited security certifications. These certifications belong to the vendors. We list them here for transparency so you can verify them directly.

• Supabase (database, auth, storage): SOC 2 Type II. Details at supabase.com/security. - Hetzner (server infrastructure, Germany): ISO 27001:2022. Certificate valid through September 2028. Details at hetzner.com/unternehmen/zertifizierung. - Vercel (frontend hosting and CDN): SOC 2 Type II, ISO 27001:2013, PCI DSS SAQ-D. Details at vercel.com/security.

Framing note: we are not SOC 2 compliant by virtue of using these providers. The correct reading is that our infrastructure runs on certified platforms while we ourselves are working toward independent certification.

Personal data breach notification: In the event of a confirmed breach affecting personal data, we will notify affected customers and the relevant supervisory authority within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33. If the breach presents a high risk to individuals, we will also notify affected individuals directly without undue delay.

Security report acknowledgment: We acknowledge all inbound security reports within 48 hours of receipt. We will keep the reporting party updated on our investigation and any remediation steps taken.

Contact: Security concerns can be reported to contact@missiongrowth.io. Please include a description of the issue, steps to reproduce it, and any relevant technical details.

Current status as of 2026-05-03: Mission Growth Limited has not yet engaged a SOC 2 auditor or a compliance platform (such as Vanta, Drata, or Sprinto). We have not commissioned a penetration test.

Our planned milestones:

• CSA STAR Registry self-assessment: We plan to complete and publish a CSA STAR self-assessment as a transparent public signal of our security posture. This is a free submission that makes our controls visible before a formal audit. - Penetration test: We intend to commission an external penetration test as we scale toward enterprise customers. - SOC 2 Type II: Our longer-term goal is to achieve SOC 2 Type II certification with an independent auditor.

We will update this page as each milestone is completed. If you need current compliance documentation for a procurement process, email contact@missiongrowth.io and we will share what we have.

No training on your data: Your data, prompts, and AI-generated outputs are never used to train AI models. This applies to all AI providers we route through.

AI providers: We use Together AI and OpenRouter as our primary AI inference providers. Together AI offers a Zero Data Retention (ZDR) option; we are verifying that ZDR is enabled on our account. OpenRouter does not store prompts or responses unless an account explicitly opts in to logging. We have not opted in.

Prompt confidentiality: Your business data, queries, and AI-generated outputs are treated as confidential. They are not shared with other customers or with third parties beyond the AI providers required to process your request.

Output ownership: All AI-generated content produced using your data is your intellectual property. We do not claim any rights over outputs you generate through the platform.

Data residency: Customer data is stored in the European Union (Frankfurt, Germany). AI inference may use providers with US-based infrastructure. Prompts sent to AI providers do not include personally identifiable information unless you explicitly provide it as part of your input.

If you discover a security vulnerability in our platform, we ask that you report it to us privately before disclosing it publicly.

How to report: Email contact@missiongrowth.io with a description of the vulnerability, the steps required to reproduce it, and any relevant technical details (screenshots, request/response samples, proof-of-concept code).

What to expect: We will acknowledge your report within 48 hours. We will investigate and keep you updated on our progress. We will notify you when the issue is resolved.

Bug bounty: We do not operate a formal bug bounty program at this stage. We will publicly credit responsible disclosures with the researcher's permission.

We ask that you do not access or modify data that does not belong to you, and that you do not perform denial-of-service attacks or automated scanning without prior agreement.