NookDocs runs as a multi-tenant SaaS hosted on Vercel + Supabase + Cloudflare. This page summarises the security posture, the controls in place today, and the documents we share with enterprise procurement teams.
Architecture overview
| Component | Provider | Region | Purpose |
| Application runtime | Vercel (Edge + Node) | Global | Next.js docs renderer + API |
| Database | Supabase (Postgres) | us-east-1 | Tenant data + auth + RLS |
| Custom domain edge | Cloudflare for SaaS | Global | TLS termination + SSL provisioning |
| Object storage | Supabase Storage | us-east-1 | Logos, images, generated assets |
| LLM gateway | Third-party LLM API gateway | Global | AI assistant + writing agent |
Encryption
| Surface | Standard |
| In transit | TLS 1.2+, HTTP/2, HSTS preload |
| At rest (DB) | AES-256 (Supabase managed) |
| At rest (object storage) | AES-256 (Supabase managed) |
| API key storage | SHA-256 hashed (Settings → API Keys never re-displays the secret) |
| Access cookie | HMAC-SHA256 signed, password-hash-derived key (rotates on password change) |
Access controls
Auth: Supabase Auth (JWT-based session cookies, email + OAuth)
Authorization: Postgres Row Level Security (RLS) on every tenant table
API auth: Dual-mode — Supabase JWT or hashed API key
SSO: SAML 2.0 + OIDC (Team+, see SSO docs)
SCIM: Read-only sync today, full lifecycle in next release (SCIM docs)
Compliance
| Standard | Status |
| GDPR | ✅ DPA template available — see DPA |
| SOC 2 Type I | In progress (target Q1 2027) |
| SOC 2 Type II | Planned Q3 2027 |
| HIPAA | BAA available on Enterprise plan with PHI use case |
| PCI DSS | Not applicable — no payment data stored on our side (Stripe handles all of it) |
Vendor questionnaire
Enterprise customers needing a vendor security review can use our pre-filled vendor questionnaire — see Vendor questionnaire.
Reporting a vulnerability
Email security@codivion.com (PGP key available on request). We acknowledge within 48 hours and ship a fix within the timeline appropriate to the severity (Critical: 24h, High: 7d, Medium: 30d, Low: next release).
Data residency
Today: us-east-1 only.
EU-region (eu-central-1) data residency is on the Enterprise roadmap. Contact sales if it's a hard requirement — early-access path is available.
Backups + DR
Daily snapshots of the Postgres database, retained 30 days
Point-in-time recovery within the last 7 days
RTO target: 4 hours
RPO target: 1 hour
What we never do
Sell customer data to third parties
Use customer docs content to train external models
Share data across tenants without explicit consent (showcase opt-in)
Read customer docs content in the course of normal support (we have RLS-immune service-role access only for incident response, audited)