Security

How We Protect Your Basalith

Last updated: September 2026

1. Encryption

Your data is encrypted at rest and in transit.

At rest: Supabase encrypts all data at rest using AES-256 encryption. Your voice recordings, photographs, and deposits are stored in private storage buckets, not publicly accessible under any circumstances.

In transit: All data transmitted between your devices and Basalith uses TLS 1.3 encryption. No data travels unencrypted.

2. Access Control

Only designated people can access your Basalith.

  • ·Owners and successors: Sign-in is passwordless. You enter your email address and we send a one-time link. No password is stored anywhere, so there is none to guess, none reused from a site that was breached, and none to steal from us.
  • ·Contributors: Authenticated via a 64-character token drawn from a cryptographically secure random source, not guessable by brute force.
  • ·iOS app: Authenticated with a token issued by Supabase Auth and verified server-side on every request. A forged or expired token is refused exactly like a missing one.
  • ·Database isolation: Row Level Security is enforced on every table at the database level, not just the application level. Even a misconfigured application cannot access data across the boundary of one Basalith.
  • ·Route enforcement: Every signed-in address is checked for a valid session before the page is resolved, not inside it.
  • ·No shared access: Your data is never visible to other owners, to contributors of another Basalith, or to Basalith employees in the normal course of operations.

3. Cloud Infrastructure

Basalith processes data on cloud infrastructure. Here is exactly where.

Where your data lives:

DatabaseSupabase (PostgreSQL on AWS)
File storageSupabase Storage (AWS S3)
Offsite backupBackblaze B2
ApplicationVercel (AWS/GCP edge network)
AI processingAnthropic API
TranscriptionOpenAI Whisper API

Each platform has its own security certifications (SOC 2, ISO 27001).

Anthropic does not train on API data by default. Your deposits and entity conversations do not improve Anthropic’s general models.

Voice and video recordings are sent to OpenAI for transcription. This covers voice recorded in the portal and the iOS app, deposits left on the phone line, and video you upload. Video is sent as a complete file and transcribed from its audio. The spoken language is detected automatically. Transcription is the only use. Nothing else on your record is sent to OpenAI.

For enterprise clients with specific data residency requirements contact enterprise@basalith.ai

4. Passwords and Multi-Factor Authentication

Basalith has no passwords.

Sign-in works by sending a one-time link to your email address. Whoever holds that inbox can sign in, and nobody else can. That removes the most common way accounts are lost, which is a password reused on a site that was later breached, and it means there is no credential of ours for an attacker to steal.

It also means your Basalith is as protected as the email account it is registered to. So the advice that matters is about that account, not about us:

  • ·Turn on two-factor authentication with your email provider.
  • ·Use a password there that you use nowhere else.
  • ·Tell us immediately if you think someone else can read that inbox.

A second factor at sign-in is something we intend to add. Doing it without locking out a family who is entitled to reach an archive, at the moment they most need to, is the part that takes care.

Security concerns: security@basalith.ai

General privacy questions: privacy@basalith.ai