How we keep your data safe.

MatchKo is early stage and we are transparent about that. We're actively working toward SOC 2 Type II — the certification is in progress, not yet awarded. Until it's done, here is everything we are doing today, so you can judge for yourself.

• TLS 1.3 for all traffic between your browser and our servers.
• AES-256 encryption at rest for the database and file storage (managed by Supabase).
• OAuth tokens for Gmail and other integrations are encrypted before being stored.
• HTTPS-only access with HSTS preload enabled on matchko.com.

• Supabase Auth with JWT-based sessions.
• Passwords hashed using industry-standard algorithms (bcrypt). We never see, log, or store raw passwords.
• Google OAuth available for single-sign-on.
• Session cookies are HttpOnly, Secure, and SameSite=Lax.
• Two-factor authentication (2FA) is on the roadmap.

• Row-Level Security (RLS) enforced on every table in our database — your data is queryable only by your own authenticated session.
• Role-based access for any future team members, with the principle of least privilege.
• Admin access to production systems is limited, logged, and reviewed.

• Hosting and edge network: Vercel (US-East primary region).
• Database: Supabase managed Postgres.
• File storage: Supabase Storage with signed, time-limited URLs.
• Background jobs and rate limiting: Upstash Redis.
• All subprocessors are listed in our privacy policy.

We apply per-IP and per-user rate limits on API endpoints via Upstash Redis. This protects your account from brute force attempts and keeps the service responsive for everyone.

• Strict Content Security Policy (CSP) headers to block unauthorized scripts.
• HSTS with preload to force HTTPS.
• X-Frame-Options: DENY and frame-ancestors 'none' to prevent clickjacking.
• X-Content-Type-Options: nosniff to prevent MIME confusion.
• Referrer-Policy: strict-origin-when-cross-origin.
• Permissions-Policy locked down for camera, microphone, geolocation.

Found a security issue? We appreciate responsible disclosure and will respond to every report.

• Email security@matchko.com with a clear description and reproduction steps.
• We acknowledge reports within 48 hours.
• Please do not publicly disclose the issue until we have had a reasonable chance to investigate and patch.
• We do not currently run a paid bug bounty program but will credit researchers who report in good faith.

In the event of a data breach that affects your personal information, we will notify affected users within 72 hours of becoming aware of the breach, per GDPR Article 33. Notifications will describe what happened, what data was affected, and what we're doing about it.

• Stripe — PCI DSS Level 1 certified.
• Google — SOC 2 Type II, ISO 27001.
• Supabase — SOC 2 Type II, HIPAA-eligible.
• Vercel — SOC 2 Type II.
• Anthropic — SOC 2 Type II.

• Use a strong, unique password. A password manager is worth it.
• Enable 2FA as soon as we ship it.
• Don't share your account credentials with anyone.
• If you use Google sign-in, enable 2FA on your Google account.
• Review connected integrations regularly in Settings > Integrations.