Skip to main content

​
Encryption

LayerImplementation
At restPostgres data is encrypted at rest by Supabase.
In transitTLS 1.2+ on every public endpoint.
BYOK exchange keysAES-256-GCM with a per-account derived key. The server stores ciphertext only.
Webhook signingHMAC-SHA256, header X-SF-Signature: sha256=<hex>.

​
Secrets handling

  • API keys — stored as Argon2 hashes. The plain secret is shown exactly once on creation, never re-listed by any endpoint.
  • Exchange keys (BYOK) — ciphertext only. Decryption happens only inside the active cloud tick process and is erased from memory immediately after the tick.
  • Webhook secrets — generated server-side per endpoint. The dashboard surfaces a one-time view; afterwards the API only returns signatureScheme: "hmac-sha256" and hasSigningSecret: true, never the secret itself.

​
Audit trail

Async workflows attach trace ids so support and audit tooling can correlate a user action, monitor cycle, alert delivery, or portfolio tick across downstream work. See Provenance.

​
Webhook receiver SSRF protection

Webhook endpoints must be HTTPS. SimpleFunctions blocks private and loopback ranges before fetching:
  • IPv4 private ranges (RFC 1918) and link-local.
  • IPv4 loopback (127.0.0.0/8) and IPv4-mapped IPv6 (::ffff:127.0.0.1).
  • Single-decimal IP forms (e.g. 2130706433 = 127.0.0.1).
  • Cloud-metadata endpoints.
Any host whose DNS resolves to one of those ranges is rejected before fetch. Email patrick@simplefunctions.dev for the current allow / deny list if you need it for a procurement review.

​
Permissions model

Each account has one or more API keys; an active key has the same access as the user that issued it. For scope-limited keys (read-only, MCP-tool allow-list, service-account isolation), email patrick@simplefunctions.dev.

​
Vulnerability disclosure

Found a security issue? Email patrick@simplefunctions.dev with reproduction steps. We acknowledge reports as soon as we can and work the fix from there. Please do not disclose publicly until a fix has shipped.

​
Incident response

Live incidents are posted at https://simplefunctions.dev/status with timeline and scope. Past incidents stay on the page for reference.

​
See also

Authentication

Auth flavors and BYOK encryption.

Compliance

Regulatory posture.

Provenance

Trace ids and audit correlation.