Security at WeLink
The security and protection of our customers' data are at the heart of everything we do. Here is how we protect your information.
Last updated: March 2026
Data hosting and location
Supabase infrastructure (EU)
All data is hosted on Supabase servers located in Europe (AWS eu-central / eu-west). The PostgreSQL database is encrypted at rest (AES-256).
Vercel hosting (EU functions)
The application is deployed on Vercel. Server functions run in the EU (Paris region); static assets are delivered through a global CDN.
File storage
Logos, avatars and banners are stored in Supabase Storage (S3-compatible, EU). Files are served through a CDN with signed URLs.
Sub-processor compliance
Core customer data is hosted in the EU. A small number of sub-processors (payments, transactional email, hosting) process limited data in the USA under Standard Contractual Clauses — the full list is in our privacy policy.
Encryption and access control
Encryption in transit (TLS 1.3)
All communication between your browser and our servers is encrypted with TLS 1.3. SSL certificates are managed automatically by Vercel and Supabase.
Encryption at rest (AES-256)
Data in the PostgreSQL database and S3 storage is encrypted at rest with AES-256. Encryption keys are managed by the cloud infrastructure and never exposed.
Row Level Security (RLS)
Every database query goes through row-level security policies (RLS). A user can only access data belonging to their own organizations.
Role management (RBAC)
Three role levels: Owner, Admin, Member. Sensitive actions (deletion, billing) are reserved for owners. Access is verified server-side on every API request.
GDPR and Swiss FADP compliance
Right of access and portability
You can export all of your personal data at any time from your account settings (JSON format).
Right to erasure
You can request the complete deletion of your account and all your data directly from the application. Deletion is immediate and irreversible.
Data minimisation
We only collect the data strictly necessary to run the service. No data is ever sold to third parties.
Sub-processors (DPA)
All our technical sub-processors (Supabase, Vercel, Stripe, PostHog) are GDPR-compliant. Data processing agreements (DPAs) are in place with each of them.
Audit and traceability
Complete audit log
All sensitive actions are recorded: logins, collaborator changes, role changes, configuration updates, data exports. Administrators can review this log from the organization settings.
Error monitoring
We use Sentry to detect and fix application errors quickly. Error data is scrubbed and does not contain personal data.
Rate limiting
Authentication endpoints and sensitive APIs are protected by rate limiting to prevent brute-force attacks and abuse.
Security practices
Content Security Policy (CSP)
Strict CSP headers protect against XSS attacks and script injection. Admin pages run a more restrictive policy than public pages.
Password policy
Passwords must contain at least 8 characters. They are hashed with bcrypt by Supabase Auth and never stored in plain text.
Secure tokens
Invitations and signature links use cryptographically secure tokens with automatic expiry (7 days for invitations).
Secure development
The code is versioned on GitHub with systematic reviews. Dependencies are updated regularly and scanned for known vulnerabilities.
Retention periods
| Data type | Retention period |
|---|---|
| Account data | Account lifetime + 30 days |
| Collaborators and signatures | Account lifetime |
| Audit logs | 12 months |
| Billing data | 10 years (legal obligation) |
| Analytics (PostHog) | 12 months |
| Error logs (Sentry) | 90 days |
Technical sub-processors
| Service | Usage | Location |
|---|---|---|
| Supabase | Database, authentication, storage | EU (Frankfurt / Ireland) |
| Vercel | Application hosting, CDN | EU functions (Paris) — USA under SCCs |
| Stripe | Payments and billing | USA (SCCs) |
| PostHog | Product analytics (opt-in) | EU (Frankfurt) |
| Sentry | Error monitoring | EU (Germany) |
| Postmark | Transactional email | USA (SCCs) |
| Upstash | Rate-limiting cache | EU |
Report a vulnerability
If you discover a security vulnerability in WeLink, we encourage you to report it to us responsibly.
Email: security@welink-app.com
Response time: 48 business hours
Policy: We commit to not pursuing legal action against researchers who report vulnerabilities in good faith.