Security Policy

CopyHub (operated by Imajin Tech Pte Ltd) is committed to maintaining the security and integrity of our services. This document explains how we protect your data, manage vulnerabilities, and respond to security issues.

All CopyHub services are hosted on Supabase, a trusted cloud platform that delivers encrypted storage, authentication, and serverless API infrastructure under strict security standards.

We follow a structured lifecycle to keep CopyHub secure:

1. Identification — We identify potential vulnerabilities through routine code reviews, automated dependency scanning, user reports, and the use of automated security screening powered by OpenAI. Our tooling continuously scans the codebase for potential weaknesses, misconfigurations, and risky patterns before they reach production.

2. Assessment — Every identified issue is classified by severity: Critical (immediate threat to data or access), High (significant exposure with limited mitigation), Medium (moderate risk in restricted scenarios), and Low (minor or theoretical).

3. Remediation — Critical and High severity issues are addressed immediately in the next scheduled release. Medium and Low severity items are resolved within regular development cycles.

4. Verification — All security fixes are reviewed and tested in a staging environment before being deployed to production, ensuring they resolve the issue without creating new problems.

Through this process we have remediated numerous issues including unauthorized workspace access attempts, cross-tenant data exposure risks, and overly permissive function access that could be exploited.

We welcome responsible security research. If you discover a vulnerability in CopyHub, please send your report to support@copyhub.live with the following:

– A clear description of the issue and its potential impact

– Steps that would allow us to reproduce it (a test workspace is helpful but not required)

– Your assessment of severity, if you have one

Our team responds to all security reports within 48 business hours. Critical and High vulnerabilities are typically resolved within 7 days of confirmation. Users are notified of significant updates through the product or by email as appropriate.

CopyHub enforces strict access controls to ensure every user can only view and modify their own data:

Workspace isolation — Each workspace's content is fully isolated from others. A user cannot see or alter information belonging to a workspace they are not a member of.

Identity verification — Every server-side operation confirms the requesting user's identity before proceeding.

Role-based permissions – Editors, viewers, and administrators each have clearly defined roles. For instance, editing members are able to work inside a workspace but cannot perform administrative actions such as transferring ownership or managing membership lists.

CopyHub does not store passwords in our database. Sign-in is handled entirely through Google or Microsoft identity providers, meaning you never need to create or manage a password for CopyHub.

When you log in, CopyHub exchanges tokens issued by Google or Microsoft for its own session tokens. These session tokens are short-lived, limiting how long they could be misused if compromised, and they expire on a regular schedule while refreshing automatically in the background so you are not constantly asked to re-authenticate.

Concurrent sign-in attempts — such as users who open CopyHub in more than one tab or device — are handled gracefully without unexpected disruptions.

– All data transmitted between your device and CopyHub is encrypted during transit.

– Data at rest is stored within Supabase's PostgreSQL cloud infrastructure, which uses encrypted storage. Supabase holds SOC 2 certification.

– Access tokens for connected services such as Figma are stored with strict per-user access restrictions and used only to perform actions you have authorized.

– Payment information is processed entirely by Stripe (PCI DSS Level 1 certified). CopyHub does not store or handle raw card numbers at any point.

All user input is validated and sanitized before it reaches our systems:

Search queries and file paths are checked for harmful patterns before being processed.

File uploads from our Figma plug-in go through strict path validation to prevent accessing unauthorized files or overwriting existing ones.

User-generated content containing HTML is properly escaped in email messages and rendered pages to prevent cross-site scripting (XSS) attacks.

CopyHub's backend API enforces multiple layers of protection for every request:

– Every protected endpoint verifies the user's identity before performing any operation.

– Cross-origin requests are accepted only from confirmed sources; requests from untrusted origins are rejected outright.

– Sensitive operations require appropriate workspace permissions, verified at runtime for each individual request.

– API keys and secrets are stored as environment variables managed by our deployment platform and are never hardcoded into the application source code.

CopyHub maintains automated database backups that can be used to restore information in the event of accidental loss or corruption. Backups are retained for up to seven days to balance recovery needs with storage efficiency.

Personal data is kept while your account is active and for up to six years afterward to satisfy legal and accounting requirements. When you close your account, we remove your workspace content within 30 days unless a longer retention period is required by law. At any time you may export your own data through the product's settings.

When a security incident occurs, we act quickly using a well-defined process:

Notification — Affected users and, where legally required, the relevant authorities are notified as promptly as possible, typically within three business days of confirmation.

Assessment — We evaluate the scope, severity, and potential impact to every affected user before deciding on the appropriate course of action.

Containment — Immediate steps are taken to stop ongoing harm. This may include revoking suspicious sessions, rotating access credentials, or deploying emergency updates.

Review — After the incident is resolved, we perform a thorough root-cause analysis, document our findings, and implement changes to prevent similar events from happening again.

Critical infrastructure events (for example, database compromise or authentication system failure) trigger an immediate priority-one response from our engineering team.

CopyHub depends on well-known third-party providers for the backbone of our services:

Our database and serverless APIs run on Supabase, a SOC 2 compliant platform that provides encrypted storage, network protection, and regular third-party penetration testing.

Payment processing is handled entirely by Stripe (PCI DSS Level 1 certified). We do not handle payment card data directly.

The Figma plugin requests only the minimum permissions needed to function. Any tokens exchanged with Figma are stored with per-user access controls so that no one but you can use them.

All third-party providers process data on our behalf under binding contractual obligations. A list of sub-processors is available upon request at support@copyhub.live.