Designed around private, least-privilege access.
Secure Watch combines identity verification, workspace isolation, role checks, provider-hosted billing, and short event retention. This overview describes implemented controls without claiming a certification or compliance status.
Identity and access
Supabase authenticates customer accounts. Protected operations resolve a stable application user and active workspace membership on the server. Owner, administrator, operator, and viewer permissions are enforced by API routes.
Camera and event isolation
Camera and event reads are scoped to the authenticated workspace. Camera uploads use hashed one-time device credentials; raw device keys are not stored or returned after creation.
Billing security
Stripe-hosted Checkout and the Stripe Customer Portal handle payment details. Webhooks are signature-verified, replay tracked, and guarded against older subscription events overwriting newer state. Live billing is currently disabled.
Data retention
A scheduled Worker removes event snapshots from R2 and their matching records from D1 after 30 days. Account deletion uses a verified request process so cancellation cannot accidentally erase operational data.
Responsible reporting
Report suspected vulnerabilities through the support channel without including passwords, tokens, device keys, or private camera images. Security controls and legal obligations require independent review before production launch.