Security and data protection

This platform holds sensitive work. We treat it that way.

Grant agreements, budgets, partner correspondence, unpublished reports: what aid organisations put into a project workspace is operationally sensitive, sometimes in conflict-affected places. This page says what protects it, in plain language, with a technical annex below for procurement and DPIA reviewers. Everything here is specific and true; nothing is claimed that is not held.

Private by default

Nothing you put into Hoverview is public unless an explicit project or donor policy publishes it. The published state of every file and figure is always inspectable by the organisation that owns it.

Isolation is enforced by the database

Access rules are enforced with row-level security in the database itself, mirroring the application's own checks. An application bug cannot become a cross-organisation data leak, because the database refuses what the application should never have asked.

Backed up nightly, and the restore is proven

The database and every uploaded file are backed up nightly, encrypted before they leave the runner, to storage held with a separate provider from the primary systems. A full restore has been performed and verified, not assumed: an untested backup is a belief, not a control.

Files are never on a public path

Uploaded documents are served only through authenticated, time-limited, non-guessable links, authorised per request against the same rules as the page you came from. There is no public bucket to misconfigure.

The record is immutable where it matters

Approved reports, locked fund flows and the audit log cannot be edited by anyone, including us. Day-to-day deletion is archival: hidden from working views, present in the record.

You can leave, with everything

Export of your project's data is built in on every tier, and account erasure is honoured. A platform arguing for transparency cannot hold its users' records hostage.

Technical annex

For the reviewer filling in the assessment form. Third parties are named and bounded.

Access control: PostgreSQL row-level security is the enforcement boundary; application-layer checks exist for usability, never as the only gate. Server-only database functions have execute revoked from client roles and are verified by privilege query, not by reading the migration. Sessions use rotating refresh tokens with a one-hour access-token lifetime.
Storage and transport: The database and authentication are hosted on Supabase; uploaded files live in Cloudflare R2, in a non-public bucket, served exclusively through short-lived presigned URLs. All traffic is HTTPS. Object keys are unique and never overwritten in place, which is what makes point-in-time recovery of files and rows consistent.
Backups: Nightly database dumps with per-table row counts and checksums, plus an additive mirror of every stored object, encrypted with age to a public key before upload, stored in Backblaze B2 (us-west-002): a different provider and account from both the database and file storage. The decryption key is held offline by the operator only; the backup pipeline can write backups it cannot read. A full production restore was performed and verified in July 2026, and restore tests recur monthly. Recovery point objective: up to 24 hours.
Analytics: the absolute half: Third-party analytics (Google Analytics) loads on public marketing pages only, never on any authenticated route. Organisation names, project identifiers, project names, user emails and beneficiary figures never reach an analytics provider. This rule has no exceptions.
AI processing: the precise half: Anthropic is a named processor that may receive project content you submit for analysis: uploaded documents and their operational data, which by construction can include organisation names, project identifiers and beneficiary figures. There is no training on customer data, and no ambient processing: AI runs on content a user submitted for that purpose, never on everything that changes in the product. Our internal AI telemetry stores token counts and cost, never prompt or completion text.
Email: Notification email is generic by design: it tells you something happened and links you to sign in. Organisation names, project identifiers, and figures stay inside the authenticated product. Delivery runs through Resend.
Beneficiary data: Hoverview stores beneficiary aggregates: counts and their disaggregations. No schema field holds an individually-identifiable beneficiary record, and raw beneficiary records are never published. Aggregation and disclosure thresholds for public surfaces are tracked as their own workstream before public aggregate dashboards ship.
What we do not claim: No compliance certifications are claimed, because none are held yet. In a sector where most tools say nothing at all about security, we would rather be specific and modest than certified-sounding and vague. Questions from a DPIA or procurement review are welcome; ask through your account.

AI-use assurance is arriving on the same procurement forms as data protection. How Hoverview answers it.