Security Posture

Data handling & roles

For data your residents provide, your government is the data controller and MyPolity is the processor. We process it only to run the services you enable, and never for advertising, partisan targeting, or resale. The full terms are in our published Data Processing Agreement.

Reference data (representatives, bills, elections) is public and sourced from official records with provenance. Engagement data (311, surveys, profiles) is tenant-scoped and access-controlled.

Access control

Authorization is enforced with row-level security (RLS) in PostgreSQL — at the data layer, not only in application code — so a request cannot read data it is not entitled to even if it reaches the database directly. Cross-tenant isolation is verified: one government tenant cannot read another tenant’s constituent data.

Citizen and government identities are separate accounts by design. Service credentials follow least privilege.

Encryption

All traffic is encrypted in transit with TLS (HTTPS), with HSTS enabled. Data is encrypted at rest at the database and storage layer.

Privacy floor on insights

Aggregate insights (issue interest, demographics, political lean) are returned only above a minimum-cell threshold, enforced in the query path. Below the floor, no breakdown is returned — so an individual cannot be re-identified from a small group. Demographic fields are opt-in. Individual records are never shown across tenants.

Subprocessors

Supabase — managed PostgreSQL and authentication (United States).

Vercel — application hosting and CDN (United States).

Resend — transactional email.

Sentry — error monitoring, configured to avoid storing constituent personal data.

All constituent data is stored and processed in the United States.

Resilience & monitoring

Automated daily database backups. Point-in-time recovery (PITR) is provisioned before any government customer goes live with constituent data.

Application errors are monitored with Sentry. Current service health is published on our status page. External reference sources are verified on a daily cadence and stamped with a last-verified date.

Vulnerability disclosure

We welcome good-faith security reports. Email security@mypolity.org or see our security.txt at /.well-known/security.txt. Please give us a reasonable window to remediate before public disclosure; we will not pursue researchers acting in good faith.

What we do not yet have — and are honest about

MyPolity is an early-stage product. We do not yet hold a SOC 2 report or other third-party security certification. We are transparent about this: what we do have is a verified RLS access model, encryption in transit and at rest, a hard privacy floor on aggregates, a documented incident-response process, and a DPA we will sign. We are happy to walk a security team through any of it.