Security

Last Updated: August 30, 2026

At Samvise, security is foundational to everything we build. We implement industry-standard security practices to protect your data and ensure the integrity of our service.

Security Overview#

Data Encryption#

We use strong encryption to protect your data at every stage:

• In Transit: All connections use TLS 1.3 encryption. We enforce HTTPS across the entire application with HSTS (HTTP Strict Transport Security) enabled.
• At Rest: Database storage is encrypted using AES-256 encryption. Backups are also encrypted.
• OAuth Tokens: Google Calendar OAuth access and refresh tokens are encrypted with AES-256-GCM authenticated encryption before storage, using a key held outside the database, and are never logged or exposed in plaintext. Key rotation is supported without downtime.
• Secrets Management: API keys and sensitive credentials are stored in secure vault storage, separate from application data.

Access Control#

We implement strict access controls to ensure data isolation:

• Row-Level Security (RLS): Every database query is automatically filtered to only return data belonging to the authenticated user. This is enforced at the database level, not just the application level.
• Authentication: We use Supabase Auth with secure session management. Sessions are validated on every request. Sign in with Apple, offered in the iOS app, is protected by your Apple account's own security, including any two-factor authentication you have enabled there.
• Session Management: You can view and revoke active sessions from your account settings. Sessions expire automatically after periods of inactivity.

Infrastructure Security#

Our infrastructure is built on trusted, security-focused platforms:

• Vercel: Application hosting with automatic DDoS protection, edge network security, and SOC 2 Type 2 compliance.
• Supabase: Database and authentication services with SOC 2 Type 2 compliance, automated backups, and point-in-time recovery.
• Google Cloud: Calendar integration via Google's secure OAuth 2.0 infrastructure.

Application Security#

We follow security best practices in our application development:

• Content Security Policy (CSP): Strict CSP headers prevent XSS attacks by controlling which resources can be loaded.
• Input Validation: All user input is validated and sanitized to prevent injection attacks.
• CSRF Protection: Cross-site request forgery protection on all state-changing operations.
• Rate Limiting: API rate limiting prevents abuse and protects against brute-force attacks.
• Security Headers: We implement X-Frame-Options, X-Content-Type-Options, and other security headers to prevent common web attacks.
• Dependency Scanning: Regular automated scanning for vulnerabilities in third-party dependencies.

AI Provider Security#

The automatic scheduler that places your tasks is a deterministic program running on our own servers. It uses no AI model, and no data leaves our infrastructure for it. The chat assistant does use an AI model, and here is how that data is handled:

• Minimal Data: We send only what the assistant needs: task titles, descriptions, due dates, time requirements, scheduling context, and the busy times synced from your calendar. Calendar busy times are limited to the event title, start and end time, all-day flag, and a count of other attendees. Event descriptions, locations, guest names, and guest email addresses are never sent, because Samvise never retrieves them.
• No Training: We do not use your data, and do not permit its use, to create, train, or improve any generalized or non-personalized AI or machine learning model. This applies to all Google user data, as required by the Google API Services User Data Policy.
• Paid API Tier: We use the paid tier of the Gemini API. Under Google's Gemini API terms, Google does not use prompts or responses sent through Paid Services to improve its products, and processes them as a data processor under its Data Processing Addendum. Google does log prompts and responses for a limited period, solely to detect abuse and to meet legal or regulatory obligations; it does not publish a retention window for those abuse-monitoring logs, and holds them separately from the request logs a Google Cloud project can keep for its own use. We do not use the unpaid tier, which carries neither commitment.
• File Sharing Consent: Attachments you add in chat are only shared with the AI provider after you grant explicit consent, which you can revoke in Settings.

Our Privacy Policy section 3 describes this transfer in full.

Monitoring and Incident Response#

We actively monitor our systems and have procedures in place for security incidents:

• Logging: Security-relevant events are logged with PII automatically redacted. Logs are retained for security analysis while respecting privacy.
• Audit Trail: Security-relevant account activity is tracked, and your active sessions are visible in your account settings.
• Alerting: Automated alerts for suspicious activity patterns and potential security issues.
• Incident Response: We have documented procedures for responding to security incidents, including notification protocols compliant with Washington State law.

Your Security Responsibilities#

Security is a shared responsibility. We recommend:

• Use a strong, unique password for your account
• Enable multi-factor authentication when available
• Keep your Apple account secure if you sign in with Apple, since it authenticates you
• Review your active sessions periodically and revoke any you don't recognize
• Log out from shared or public devices
• Report any suspicious activity to us immediately

Reporting Security Issues#

If you discover a security vulnerability, please report it responsibly:

• Email: security@samvise.io
• Response Time: We aim to acknowledge reports within 48 hours and provide updates as we investigate.
• Responsible Disclosure: Please allow us reasonable time to address issues before public disclosure.

We appreciate security researchers who help us keep Samvise secure.

Compliance#

We are committed to maintaining high security standards:

• Google API Compliance: Samvise's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Infrastructure Compliance: Our hosting providers (Vercel, Supabase) maintain SOC 2 Type 2 compliance.
• Data Protection: We implement technical measures aligned with GDPR and Washington State privacy requirements.

Contact#

For security questions or concerns, contact us at:

security@samvise.io

---

Last updated: August 30, 2026