Security & Data Architecture

• Supabase (PostgreSQL) database hosted on AWS US East (Virginia)
• All data encrypted at rest (AES-256) and in transit (TLS 1.3)
• PostGIS extension for spatial queries and pole geolocation
• Vercel Edge Network for global CDN and DDoS protection

AcreSeal's production stack includes verified integrations with the NOAA National Weather Service for the nearest-station weather observation recorded with each complaint, Anthropic Claude for AI-assisted classification, Resend for transactional email, and Supabase for database and authentication. See the full integration list on the Enterprise page.

• Row Level Security (RLS) enforced on all database tables
• Role-based access: landowner (public, anonymous), utility_manager (authenticated), field_inspector (authenticated), puc_auditor (read-only)
• Authentication via Supabase Auth — email magic link for utility staff
• Session management with automatic refresh and expiry
• No passwords stored — magic link authentication eliminates credential theft risk

• Every landowner complaint, and each entry in its audit trail (status changes, inspector assignments, resolution), receives a SHA-256 hash computed from the record content and timestamp
• Hash chain: each record's hash links to the previous record's hash, creating an append-only audit trail
• Each timeline entry stores the hash of the entry before it, so a removed, reordered or inserted entry shows up as a broken link on the public record check. The check compares links; it does not re-hash what each entry says.
• Photo integrity: two SHA-256 digests are kept for each photo, one of the file as the reporter's browser prepared it before upload, and one of the stored file after AcreSeal adds its provenance EXIF
• AcreSeal writes a provenance block (the report's location, the upload time and the photo digest) into each stored JPEG. Photos over 2 MB are resized in the browser first, which removes the camera's own EXIF; the camera time, GPS and device are read beforehand and stored with the record.

• Landowners may report anonymously — name, phone, and email are optional
• Personal information is never sold. It goes only to the assigned utility and to the vendors listed on our privacy page, each for the purpose stated there
• Aggregated, anonymized data may be used for community infrastructure insights
• Reporter email and phone are encrypted at rest. Who can see them is limited to AcreSeal staff and the assigned utility, as our privacy page sets out.

• Input validation via Zod schemas on the public report intake and on many other API endpoints
• Rate limiting on complaint submission, photo upload and the public record check
• CAPTCHA (Cloudflare Turnstile) on anonymous forms to prevent automated submissions
• Content Security Policy headers enforced via Vercel configuration
• Google Maps API key restricted by HTTP referrer and API scope

• Built to support the landowner-complaint element of a pole plan, Tex. Util. Code §38.103(b)(5).
• A complaint's timeline entries are written to a log whose database triggers refuse edits and deletions

AcreSeal has no SOC 2 report. No third-party assessor has reviewed these controls. A third-party security audit is planned upon the first paying customer engagement, and its findings will be summarized publicly at completion.

• We target 99.9% uptime. This is a target, not a guarantee, and no contract carries an uptime commitment.
• Pages are served through Vercel's network; the database is hosted by Supabase on AWS US East
• Daily backups are provided by our database host.
• Scheduled maintenance is announced at least 24 hours in advance when possible, as our terms of service state

• Notification: affected customers are told within 72 hours of confirming an incident.
• Responsible disclosure: Security researchers may report vulnerabilities to security@acreseal.com