1. Overview

Security is foundational to how Requo is built and operated. This page describes the technical and organizational measures we use to protect your data across encryption, authentication, access control, infrastructure, and compliance.

2. Encryption

In Transit

All data transmitted between your browser and Requo is encrypted using TLS 1.3. This applies to all pages, API endpoints, and file uploads. Older TLS versions are not supported.

At Rest

Data stored in our database and file storage is encrypted at rest using AES-256 via Supabase. Encryption keys are managed by the infrastructure provider and rotated automatically.

3. Authentication

Requo supports multiple authentication methods to balance security and convenience:

• Email verification: All accounts require a verified email address before access is granted.
• OAuth: Sign in with Google for passwordless access via trusted identity providers.
• Magic links: Passwordless email-based sign in for reduced credential risk.
• MFA (roadmap): Multi-factor authentication is on our roadmap for additional account protection.

4. Access Control

Requo enforces strict data isolation between businesses:

• Role-based access: Users are assigned roles (owner, member) that determine what actions they can perform within a business.
• Business-scoped isolation: All queries and mutations are scoped to the active business context. Users cannot access data belonging to other businesses.

5. Infrastructure

• Hosting: Requo is deployed on Vercel, which provides automatic scaling, DDoS protection, and edge network distribution.
• Database and storage: Supabase hosts the PostgreSQL database and file storage in the configured project region, with automated backups and point-in-time recovery.

6. Compliance Alignment

Requo aligns its data handling practices with the following frameworks:

• Data Privacy Act of the Philippines (Republic Act No. 10173): As a Philippines-based company, we comply with the national data privacy law governing the collection, processing, and storage of personal information.
• GDPR-aligned practices: We follow GDPR principles including data minimization, purpose limitation, lawful basis for processing, and data subject rights regardless of user location.

7. Security Headers

Requo applies the following HTTP security headers to all responses:

• Strict-Transport-Security (HSTS): Forces browsers to connect only over HTTPS, preventing downgrade attacks.
• Content-Security-Policy (CSP): Restricts script, style, and resource origins to prevent cross-site scripting and injection attacks.
• X-Frame-Options: Prevents the application from being embedded in iframes, protecting against clickjacking.
• X-Content-Type-Options: Prevents browsers from MIME-sniffing responses, reducing drive-by download risk.

8. Responsible Disclosure

We welcome responsible security research. If you discover a vulnerability in Requo, please report it to us so we can address it promptly.

Contact

Report vulnerabilities to security@requo.app.

Scope

Eligible targets include the https://requo.app domain, its subdomains, and APIs. Out of scope: third-party services, social engineering, denial-of-service, and physical attacks.

Safe Harbor

We will not pursue legal action against researchers who report vulnerabilities in good faith, follow responsible disclosure practices, and avoid accessing or modifying other users' data.

Response

We aim to acknowledge reports within 5 business days and will work with you to understand and resolve the issue. We ask that you give us reasonable time to address the vulnerability before any public disclosure.

For machine-readable security contact details, see our security.txt.