Security
Canopy holds a map of how your systems fit together - so we treat that picture as sensitive by default. These pages cover how Canopy protects your data, what we store, the controls you have, and how to use them well.
Overview
Private by default
Maps and workspaces are workspace-only until you publish.
Row-Level Security
Postgres RLS enforces workspace isolation at the database layer.
Encrypted in transit & at rest
HTTPS/TLS on every request; data encrypted at rest by the managed DB provider.
No payment data on our servers
Billing runs through Stripe. Canopy never sees or stores your card details.
Role-based access
Owner, Admin, Editor, and Viewer roles are assigned per workspace.
Public maps are opt-in
Nothing is public unless you explicitly publish a map or share link.
At a glance
- Private by default - maps, workspaces, and cost are scoped to your workspace and visible only to its members. Nothing is public unless you explicitly publish it.
- Workspace isolation - every row in the database is guarded by Postgres Row-Level Security (RLS), so one workspace can never read another's data, even through the API.
- Encrypted in transit and at rest - all traffic is served over HTTPS/TLS, and data is encrypted at rest by our managed Postgres provider.
- No payment data on our servers - billing runs through Stripe; Canopy never sees or stores your card details.
- Role-based access - Owner, Admin, Editor, and Viewer roles are assigned per workspace, so people only get the access they need.
How access works
Authentication is handled by Supabase Auth - you sign in with GitHub OAuth or email and password. Canopy hashes passwords and never stores them in plain text.
Once signed in, every read and write is checked twice:
- Application layer - routes verify your session and the active workspace.
- Database layer - RLS policies re-check ownership on every query, so a bug in the app can't expose another workspace's rows.
Public profiles and public maps are the one exception - they're served through a narrow, read-only path that exposes only the maps you've explicitly marked public. See Data & privacy for the details.
On the roadmap
SSO/SAML, audit logs, and SOC 2 attestation are not part of the current product. If your org requires them today, talk to support and we'll share our timeline.
Where to go next
- Data & privacy - what Canopy stores, RLS isolation, encryption, and public vs private.
- Two-factor authentication - authenticator-app codes, recovery codes, and how they are enforced.
- Best practices - secrets, least access, sharing, sign-in, and API tokens.
- Report a vulnerability - how to reach us, and what we commit to.