Security
How we protect Vistui.
A plain-language overview of current security practices — not aspirational future claims.
Authentication
Account access uses Supabase Auth (email/password and Google sign-in where enabled), with session cookies managed by the app.
Data access
Project data is scoped with Postgres row-level security so authenticated users only access their own workspace content by default.
Transport
Traffic to vistui.com and Supabase is served over HTTPS/TLS in production.
Payments
Card payments are processed by Stripe. Vistui does not store full card numbers on our servers.
Operations
Admin actions (credits, suspensions, CMS) are limited to elevated accounts. We continue to harden logging and retention as the product grows.