Security Centre
Disclosurely is built for sensitive reporting workflows with transport encryption, server-side encryption at rest, tenant isolation, role-based access controls, audit logging, managed operations, and GDPR-conscious design.
This page is written for IT, procurement, legal, and security review. It describes the current production platform unless an item is explicitly marked as in progress, planned, or available on request.
Executive summary
Disclosurely is a multi-tenant whistleblowing and case management platform. Customer data is organised by organisation, protected in transit with TLS, stored with server-side encryption controls, and accessed through organisation-scoped roles and audit-backed workflows.
Core case data is stored in the single EU Supabase production project. Customers cannot select a hosting region. Confirm processing locations for authentication, email, logging, backups and other supporting services during security review.
Supplier Due Diligence
Disclosurely is designed to make supplier security reviews straightforward. This page provides an overview of our security controls, infrastructure and operational practices. If additional documentation is required, please contact us.
Security Centre
This page — controls, architecture, and operational practices.
OpenPrivacy Policy
Controller/processor roles, retention, and privacy contacts.
OpenData Processing Agreement
DPA materials for procurement and legal review.
OpenSubprocessors
Supporting services used by the production platform.
OpenIncident Response
Incident response summary for supplier reviews.
OpenBusiness Continuity
Continuity and recovery summary for due diligence.
OpenContact Security
Procurement and security enquiries.
OpenSecurity Overview
A concise overview of the current production security model.
Security-first product design
Disclosurely is designed for whistleblowing and case handling workflows where confidentiality, controlled access, and traceable actions matter from the first submission through case closure.
Encryption in transit and at rest
Data is protected with TLS in transit and encrypted at rest. Report descriptions and secure messages also receive an additional layer of application-level encryption.
Multi-tenant by default
Customer data is logically isolated per organisation. Access paths are organisation-scoped, supported by Row Level Security and role-aware permission checks.
Auditable operations
Case activity, user activity, workflow changes, and security-relevant events are recorded so customers can review the lifecycle of a report and the actions taken around it.
Managed platform operations
The production platform relies on managed delivery, data, and storage services so core controls can be reviewed and hardened without customer-operated infrastructure.
Privacy-first handling
Anonymous reporting does not require an account, reporters' IP addresses and device details are not stored with their reports, and common file metadata is removed on upload. Anonymity also depends on what reporters choose to share.
Security Roadmap
Security controls in place today.
Completed
- MFA
- Encryption at rest & in transit
- Audit logging
- Security Centre
- Role-based access
Trust Centre Resources
Procurement, security, legal, and compliance references grouped by the review path buyers usually follow.
Security
Identity, access, session, encryption, and monitoring references for IT security review.
Compliance
GDPR, EU Directive, retention, audit, and regulatory context for legal and compliance review.
Reporting
Anonymous reporting, secure messaging, report types, and reporter journey references.
Cases
Investigation workflow, evidence, and file-handling references for case management review.
Architecture
Disclosurely runs as a managed web application with optional AI processing outside the core reporting path rather than inside the submission flow.
Request flow
- 1. A reporter or case manager reaches the reporting portal through the managed web application.
- 2. The application uses managed identity, storage, and core data services for authentication and organisation-scoped operations.
- 3. Core case data is stored in the single EU Supabase production project. Customers cannot select a hosting region. Confirm processing locations for authentication, email, logging, backups and other supporting services during security review.
- 4. Audit records, workflow events, and related security-relevant actions are recorded alongside the case lifecycle.
- 5. Optional AI processing is invoked only when a user requests supported AI functionality. It is not part of the default reporting path.
Application delivery
Runs the public-facing application through managed delivery infrastructure with HTTPS, request handling, and web-layer protections for the reporting portal.
Core platform services
Supports authentication, organisation-scoped data handling, encrypted storage, and the core data services used by the production platform.
Transactional email
Used for platform notifications and verification-related delivery only. It is not presented as a reporting-data workspace.
Billing systems
Handles billing and subscription events only. It is separate from the reporting and case-handling path.
Operational monitoring
Supports production issue investigation with masking controls so faults can be reviewed without treating operational telemetry as a reporting-data export channel.
Authentication
Disclosurely uses an email-based authentication model designed to reduce credential exposure while keeping access scoped to the relevant organisation.
- Sign-in uses single-use email verification codes, or Google or Microsoft sign-in.
- Accounts also have a password, which is stored and verified by our authentication provider.
- One-time verification codes and one-time sign-in codes are issued during authentication flows.
- Authentication codes and related sign-in tokens are short-lived and limited to the requested verification or session-establishment step.
- Secure session management tracks active sessions and related activity after sign-in.
- Organisation-based permissions determine the data and actions available to each user.
- Role-based authorisation is enforced through organisation-aware role and permission records.
- MFA is available in the current production platform.
Disclosurely uses single-use email verification codes for authentication. Magic-link sign-in is intentionally avoided to maximise compatibility with enterprise email security gateways that inspect links before users interact with them.
MFA is available in production. SSO remains planned for future enterprise tiers and is not represented here as a currently available control.
Encryption
Disclosurely uses transport and server-side encryption controls to protect report data and related evidence. The platform should not be described as end-to-end encrypted.
- TLS is used for communication between browsers, the frontend, and platform services.
- Data in our database and file storage is encrypted at rest by our infrastructure provider.
- Report descriptions and secure messages also receive application-level encryption (AES-256-GCM) before they are stored.
- Encrypted report handling is organisation-scoped, with access tied back to organisation permissions and case roles.
- Uploaded files are kept in private, access-controlled storage linked to the report.
- Files uploaded through the reporting portal are processed to remove common identifying metadata.
- Authorised users within an organisation can decrypt and view reports according to their permissions and assigned access.
Encryption in Disclosurely protects data in motion and at rest, but it does not prevent authorised users inside the relevant organisation from decrypting and working on reports when their role allows it.
Tenant Isolation
Customer organisations are logically isolated within a shared production platform.
- Organisations are logically isolated inside a multi-tenant architecture.
- Row Level Security is enabled on core customer data tables, including organisations, reports, profiles, and related operational records.
- Organisation-scoped queries are used throughout the production data model to keep access bound to the relevant tenant.
- Role-based access enforcement sits alongside tenant boundaries so users only see the cases and records their role permits.
- Recent tenant-isolation hardening work has strengthened production organisation boundaries without exposing sensitive implementation detail.
- Isolation controls continue to be reviewed as part of ongoing security improvement work.
Anonymous Reporting
Disclosurely includes an anonymous reporting route designed to let whistleblowers submit and follow up on reports without creating an account.
- A dedicated anonymous reporting portal supports account-free submission.
- Optional file uploads are supported for evidence and supporting material.
- Common identifying metadata is removed from uploaded files. Files can still contain identifying details, so reporters are encouraged to check them before uploading.
- Anonymous two-way messaging allows follow-up questions and clarifications without requiring identity disclosure.
- Reporters use a tracking ID together with a private access secret to return to their report.
- Reporters' IP addresses and device details are not stored with anonymous reports or shown to organisations.
- Anonymity also depends on what reporters write and upload, so it cannot be guaranteed in every case.
Audit & Compliance
Case handling and operational accountability are supported by structured audit history and lifecycle tracking.
- Case lifecycle events are recorded from submission through review, investigation, and closure states.
- Audit history captures user activity, workflow activity, and related operational metadata.
- Exportable audit history supports legal, governance, and customer review requirements.
- Workflow logs, security events, and related audit records help preserve operational traceability around sensitive cases.
- Internal Disclosurely support activity is kept separate from customer audit records through dedicated internal audit logging.
Customer audit history is distinct from internal founder or support activity. That separation helps preserve a cleaner customer-facing record during investigations and reviews.
Infrastructure
Production infrastructure relies on managed services for delivery, compute, database operations, storage, and supporting controls.
Managed application delivery
The web application is delivered through managed hosting with HTTPS, request handling, and network-layer protections for the public-facing service.
Core data services
Managed database, authentication, encrypted storage, and organisation-scoped access controls support the production data model.
Web-layer protections
HTTPS is used across the platform, and the web layer applies controls such as CSP, frame restrictions, referrer policy, and MIME-type protections.
Webhook verification
Internal webhook handling verifies provider signatures before events are processed.
Rate limiting and lockouts
Sensitive authentication flows apply throttling and lockout controls to reduce abuse and repeated verification attempts.
Ongoing hardening
Production security improvements are made continuously as the platform evolves and controls are reviewed.
Data Residency & Infrastructure
How customer data relates to the Disclosurely platform and supporting services.
- Core case data is stored in the single EU Supabase production project. Customers cannot select a hosting region. Confirm processing locations for authentication, email, logging, backups and other supporting services during security review.
- Disclosurely uses a small number of trusted subprocessors for delivery, billing, email, optional AI, and operations.
- Appropriate contractual safeguards are in place where applicable.
- Subprocessors do not receive unrestricted access to customer data.
- Category-level service roles are listed in Supporting Services below for procurement review.
Backups & Recovery
Production data is held on managed infrastructure.
- The production database and file storage run on Supabase's managed platform in the EU.
- Backup, recovery-point and recovery-time commitments are not offered as standard. Any such commitments must be agreed in writing.
AI & Data Processing
AI support is available for selected case workflows, but it is optional and outside the default submission path.
- AI features are optional.
- AI is used only when requested by an authorised user.
- Reports are not automatically processed by AI as part of the core reporting flow.
- Supported AI functionality currently covers summarisation, categorisation, and analysis assistance.
- Customer data remains encrypted at rest in the core platform data layer.
- AI processing relies on approved third-party providers when enabled.
- Current service categories are listed in the Supporting Services section.
- Disclosurely does not use customer data to train AI models.
- AI processing is limited to the requested functionality and routed through logged, organisation-scoped request handling.
AI output is designed to assist case handling, not replace human judgement, legal review, or governance decisions.
GDPR & Privacy
Disclosurely is operated with UK GDPR and EU GDPR considerations in mind, with controls aimed at minimisation, accountable processing, and customer control over report data.
- Privacy by design informs product decisions for sensitive reporting workflows.
- Customer report data is handled with export and deletion request workflows in the production data model.
- Organisation-level retention controls are available through retention policy records.
- Privacy handling is described alongside controller and processor roles in the Privacy Policy.
- UK GDPR and EU GDPR considerations are reflected in hosting, retention, deletion, export, and access-control design.
For controller and processor roles, retention details, international transfer handling, and contact information, review the Privacy Policy.
Supporting Services
Current service categories used by the production platform and public site.
| Service Area | Purpose |
|---|---|
| Core platform services | Authentication, organisation-scoped data handling, object storage, and core server-side platform operations. |
| Application delivery | Public web application hosting, delivery, and runtime support. |
| Transactional email | Verification-related and operational email delivery. |
| Billing systems | Subscription and billing processing. |
| LLM provider (optional AI services) | Supported AI-assisted summaries, categorisation, and analysis flows when enabled. |
| Operational monitoring | Error monitoring and production issue investigation. |
| Site analytics | Microsoft Clarity session analytics on the public marketing site, loaded only after analytics consent; never used on the reporting portal. |
| Support chat | Chat provider support chat widget on public marketing pages, loaded only after consent. |
Documentation
Core documents used during supplier security reviews. Downloadable PDFs can be added here as they become available.
Incident Response Summary
Summary of incident response practices for supplier due diligence.
Available on request.Business Continuity Summary
Summary of continuity and recovery practices for procurement review.
Available on request.Data Processing Agreement
DPA materials for legal and procurement review.
Available on request.Privacy Policy
Current privacy terms, controller and processor roles, data handling, and contact details.
ViewBusiness Insurance
Insurance coverage held by the business. Policy information is available upon request.
Professional Indemnity Insurance
Professional indemnity cover is in place. Policy details are available upon request.
Available upon request. Cover values are not published on this page.
Public Liability Insurance
Public liability cover is in place. Policy details are available upon request.
Available upon request. Cover values are not published on this page.
Security Contact
Procurement and security enquiries can be directed to the address below.
security@disclosurely.com
Use this contact for supplier questionnaires, security reviews, procurement due diligence, and related trust documentation requests.
Responsible Disclosure
We are committed to protecting Disclosurely and the organisations that rely on it. We appreciate responsible, private reporting of security issues.
How to report a vulnerability
Please email security@disclosurely.com with a clear description of the issue, steps to reproduce where possible, and any relevant impact assessment. You can also reach us via our contact page.
We aim to acknowledge reports within 2 business days and will keep you updated as we investigate and remediate.
Responsible disclosure guidance
- Give us a reasonable opportunity to investigate and fix the issue before public disclosure.
- Do not access, modify, or exfiltrate customer data, or attempt to disrupt the availability of Disclosurely services.
- Avoid privacy violations, destruction of data, and interruption or degradation of service.
- Act in good faith and only interact with systems you are authorised to test as part of a coordinated report.
We appreciate researchers who help us improve security. Provided you follow this guidance, we will not pursue legal action for good-faith reports.
PGP encryption for vulnerability reports will be supported soon. Until then, email security@disclosurely.com directly.
Security Updates
Recent hardening work recorded for this Trust Centre. Dates below reflect the documentation record for recent production-focused improvements.
- Recorded2026-07-13Note 01
Tenant isolation hardening
Production organisation boundaries were tightened to reinforce organisation-scoped access paths and strengthen isolation controls across sensitive workflows.
Impact: Reduces the risk of cross-organisation access and improves confidence in tenant boundary enforcement. - Recorded2026-07-13Note 02
Anonymous messaging hardening
Anonymous follow-up flows were reviewed and tightened so reporters can continue two-way communication without creating an account or exposing their identity.
Impact: Improves protection around anonymous follow-up without changing the core reporting workflow. - Recorded2026-07-13Note 03
Attachment integrity validation
Evidence handling was improved around private attachment storage, access tracing, and related upload controls.
Impact: Strengthens confidence that uploaded evidence remains intact and tied to the correct report context. - Recorded2026-07-13Note 04
Webhook signature verification
Internal webhook processing was updated to verify provider signatures before events are accepted and processed.
Impact: Reduces the chance of unauthorised or spoofed webhook traffic being processed by the platform. - Recorded2026-07-13Note 05
Founder Console isolation
Internal support and founder activity was separated more clearly from customer tenant records and audit history.
Impact: Improves separation between internal operational activity and customer-visible audit records. - Recorded2026-07-13Note 06
Role-based authorisation improvements
Role definitions and permission handling were refined to keep access closer to job function and organisation scope.
Impact: Narrows access to the actions and records needed for each role, supporting least-privilege handling. - Recorded2026-07-13Note 07
Authentication flow improvements
Email-based sign-in flows, verification handling, and session-related controls were reviewed and improved in production.
Impact: Improves reliability and control around verification, sign-in, and active session handling. - Recorded2026-07-13Note 08
Security review programme
Security changes are reviewed continuously, with production improvements informed by internal reviews and customer feedback.
Impact: Creates a repeatable path for hardening work instead of treating security changes as one-off tasks.