Security
Last updated: 23 June 2026·Version: 1.0
1. Our commitment
MyCapsule AS builds MyCapsule with security and privacy as core design principles. We process sensitive workforce well-being data on behalf of our customers and apply technical and organizational measures to protect it.
This page summarizes our security practices. For contractual commitments, see our Data Processing Agreement. For subprocessors, see the Subprocessor List.
2. Infrastructure and hosting
| Component | Provider | Details |
|---|---|---|
| Application hosting | Vercel | Serverless deployment with HTTPS/TLS for all traffic |
| Database & authentication | Supabase | Hosted in West EU (Ireland); PostgreSQL with Row Level Security |
| Payments | Stripe | PCI-compliant payment processing; card data never stored in MyCapsule |
| SMS delivery | Twilio | Used when enabled for survey distribution |
3. Data protection by design
3.1 Aggregation in reporting
- Individual pulse responses are not displayed in the application interface
- Dashboards show department- and company-level aggregates only
- Groups with fewer than the configured minimum (default: 5 responses) are hidden from reports
- Response records do not include employee name or phone number
3.2 Database access controls
- Row Level Security (RLS) is enabled on all tables containing customer and employee data
- Direct client-side read access to individual pulse responses is blocked by policy
- Survey submission uses security definer functions with token validation — responses can only be submitted via valid, unexpired survey links
- Aggregated metrics are exposed through controlled database functions with company-scoped access checks
3.3 Role-based access
| Role | Access scope |
|---|---|
| Administrator | Own company data only — employees, departments, aggregated reports, settings |
| Health partner | Assigned company(ies) — aggregated reports and action tracking only |
| Super administrator | Platform operations — restricted to MyCapsule AS personnel |
| Survey respondent | Anonymous token-based access to submit one response per survey link |
4. Authentication and session security
- Passwords are hashed by Supabase Auth — never stored in plaintext
- Session tokens are managed via secure HTTP-only cookies (Supabase SSR)
- Google OAuth available as an alternative sign-in method
- Server-side API functions validate JWT tokens before processing requests
- Service role keys are server-only and never exposed to the browser
5. Encryption
| Layer | Measure |
|---|---|
| In transit | TLS 1.2+ (HTTPS) for all client-server and API communication |
| At rest | Database encryption at rest provided by Supabase infrastructure |
| Secrets | API keys and credentials stored as environment variables, not in source code |
6. Operational security
- Audit logging: administrative actions are recorded with actor identity and timestamp
- SMS logging: delivery status and message content logged for troubleshooting and compliance
- Environment separation: development and production use separate Supabase projects
- Access management: production database access restricted to authorized personnel
- No third-party analytics: we do not embed analytics trackers that collect personal data
7. Incident response
In the event of a suspected or confirmed security incident affecting customer data:
- Contain and assess the incident
- Notify affected customers without undue delay (within 48 hours per our DPA)
- Cooperate with customers on regulatory notifications where required
- Document root cause and implement remedial measures
Report security concerns to morten@mycapsule.eu.
8. Data retention and deletion
- Employee records are deactivated immediately upon customer termination
- Personally identifiable employee data is deleted or anonymized within 30 days
- Aggregated and anonymized analytics may be retained for benchmarking
- Customers may request data export before termination
See our Privacy Policy for full retention schedules.
9. Compliance and assessments
- GDPR-aligned data processing with published Privacy Policy and DPA
- Subprocessor due diligence documented in our Subprocessor List
- DPIA template available for customers on request
- Third-party certifications (e.g. SOC 2, ISO 27001) from subprocessors where available
Enterprise customers may request additional security documentation or complete a security questionnaire. Contact morten@mycapsule.eu.
10. Responsible disclosure
If you discover a security vulnerability in MyCapsule, please report it responsibly to morten@mycapsule.eu. Do not publicly disclose vulnerabilities before we have had a reasonable opportunity to address them.
11. Contact
MyCapsule AS
Gulaksvegen 31, 4345 Bryne, Norway
Security inquiries: morten@mycapsule.eu