Security

Effective date / last updated: August 21, 2026

This page describes measures MicroHub actually implements today. No system is invulnerable, and this page makes no absolute-security or formal-security-certification claim about MicroHub.

Access control

Access is role-based: customers, vendors, and internal employee roles each see only the surfaces appropriate to their role, enforced on the server for every request, not just hidden in the interface.

Storage

Uploaded files are stored in private cloud storage. Files are not publicly browsable; access is granted only through short-lived, signed links minted by an authorized server request. (One bucket containing generic product/package reference photography — never customer or confidential data — is intentionally public so it can render in generated quote documents.)

Authentication

Sign-in uses Supabase Auth. We apply rate limiting and temporary lockouts after repeated failed sign-in attempts, and log IP address, user-agent, and sign-in outcome to detect suspicious activity.

Secrets and credentials

Provider API keys, webhook secrets, and similar credentials are handled server-side only and are never sent to the browser. Configuration values shown in any admin interface are masked.

Infrastructure

MicroHub runs on Vercel (hosting) and Supabase (database, authentication, storage), each of which provides HTTPS transport encryption. Production and development environments are kept separate.

Reporting a vulnerability

If you believe you have found a security vulnerability in MicroHub or PressRoom, please report it to support@microdynamics.net rather than disclosing it publicly.