Security at StreamRev
StreamRev handles your royalty statements and account credentials, so protecting that data is core to the product, not an afterthought. This page summarizes how we approach security. As an early-stage beta, our practices are evolving, and we'll keep this page current.
Authentication
Sign-in is handled by Supabase Auth. Passwords are never stored by StreamRev in plain text, and password resets go through Supabase's email-verified recovery flow. Sessions are carried by short-lived signed tokens.
Data in transit & at rest
- All traffic between your browser and StreamRev is encrypted with TLS.
- Your data is stored in managed Postgres with access controls and row-level scoping so one account cannot read another's data.
- When we store third-party session material for connected sources, it is encrypted before it is written, and the source password is never held in our web process.
Least privilege & auditability
Every royalty figure in the product traces back to a specific statement you uploaded or synced. We favor honest, auditable numbers over estimates presented as fact, and we scope access to the minimum needed to do the job.
Responsible disclosure
If you believe you've found a security vulnerability, please email streamrevmusic@gmail.com with details and steps to reproduce. Please give us a reasonable window to remediate before any public disclosure. We appreciate the help and will acknowledge your report.