Security
Last updated: 26 September 2026
Your data security matters. Here's what we do today to keep Firmwatcher secure.
Data protection
UK GDPR
We process personal data under UK GDPR and the Data Protection Act 2018, with a published privacy policy and a data-controller contact.
UK-hosted database
Your workspace data is held in a UK-hosted database (London, AWS eu-west-2), run by Supabase. Some processing happens outside the UK – for example email delivery and product analytics. We do not sell customer data; we share it only with the sub-processors listed below.
Technical baseline
Encryption in transit & at rest
- • All HTTP traffic is served over TLS (managed by Vercel)
- • Passwords are never stored in plaintext – auth is delegated to Supabase, which hashes them
- • Database storage is encrypted at rest by Supabase (Postgres on AWS, London)
Access control
- • Authentication is handled by Supabase Auth (email + password)
- • Workspace data is scoped per workspace; our API doesn't return another workspace's data
- • SSO (SAML / OIDC) and enforced MFA are not yet available
Infrastructure
- • Hosted on Vercel, with server functions in London; database and auth on Supabase in London (AWS eu-west-2)
- • Background jobs (FCA register checks, alerts) run on Trigger.dev
- • Both Vercel and Supabase provide DDoS protection at the edge
Sub-processors
Firmwatcher is built on the following vendors. Their security certifications are theirs, not ours – listed here so you can include them in vendor due diligence.
| Vendor | Purpose | Vendor certifications |
|---|---|---|
| Supabase | Database and authentication (London, AWS eu-west-2) | SOC 2 Type II (per Supabase) |
| Vercel | Hosting (server functions in London) and cookieless web analytics | SOC 2 Type II, ISO 27001 (per Vercel) |
| Trigger.dev | Background jobs: FCA register checks and alerts | See trigger.dev/security |
| Resend | Email delivery; demo request contacts | See the vendor’s security documentation |
| PostHog | Product analytics and error reports | See the vendor’s security documentation |
| Cal.com | Demo booking | See the vendor’s security documentation |
| Pushover | Internal notification of demo requests | See the vendor’s security documentation |
| Vercel AI Gateway | AI summaries of public FCA enforcement notices – no customer data | As Vercel |
| CookieChimp | Cookie notice | See the vendor’s security documentation |
Backups & continuity
Database backups are provided by Supabase under their managed plan. We do not currently offer a formal availability commitment (SLA).
For FCA-regulated firms
Firmwatcher may help support certain compliance workflows:
- Third-party monitoring: A check of the FCA Financial Services Register every morning for the firms and individuals on your watchlist
- Audit log: A record of acknowledgements and watchlist changes, exportable as CSV
We are not a substitute for your own internal controls. Need vendor due diligence information? Email security@firmwatcher.com.
Reporting security issues
Found a vulnerability? Please report it responsibly:
- Email details to security@firmwatcher.com
- Please don't publicly disclose it until we've had a chance to fix it
- We'll acknowledge your report and keep you informed of progress
We're grateful for responsible security researchers and won't take legal action against good-faith reports.
Your responsibility
- Use a strong, unique password
- Don't share login credentials
- Keep the email account you signed up with secure
- Tell us immediately if you suspect compromise
Questions?
For security or compliance questions, email security@firmwatcher.com.