Authentication

Email + password with a hashed and salted password store.
Sign in with Google (OAuth 2.0).
Email verification required before use.
Password reset via one-time email link.

Data isolation

Row-level security (RLS) on every table containing user data.
Per-user private storage buckets for uploaded files.
Administrators can only access user data through auditable server-side flows (for example, when you file an issue report).

Encryption

TLS 1.2+ for all network traffic.
Encryption at rest on our managed database and storage.
Secrets stored in the platform secrets manager, never in source code.

Platform & hosting

MyGavel runs on managed cloud infrastructure with automated backups, patching, and access-controlled administrative operations. Server-side privileged operations require role-checked, authenticated requests — no service-role keys are exposed to the browser.

Payments

Payments are processed by our PCI-DSS compliant payment provider. MyGavel never sees or stores your full card number.

Shared responsibility

Security is a partnership. Please choose a strong, unique password; keep your email account secure; sign out on shared devices; and only upload documents you are comfortable storing on our infrastructure.

Responsible disclosure

If you believe you've found a security vulnerability, please email security@mygavel.net with:

A clear description of the issue and how to reproduce it.
The affected URL(s) and, if applicable, a proof-of-concept.
Your contact info so we can follow up.

Please do not exploit the issue beyond what is necessary to demonstrate it, do not access or modify other users' data, and do not run automated scanners at high rates against production. We commit to acknowledging your report within three business days.

Security at MyGavel