Your proposals and client data are sensitive. ChaseNudge is built with security at every layer: from encrypted storage to secure email connections.
Encryption for stored tokens
All data encrypted in transit
We never store your email password
ChaseNudge runs on Cloudflare Workers: a globally distributed edge network with built-in DDoS protection, automatic failover, and no single point of failure.
All data is stored in Supabase (built on PostgreSQL) with Row Level Security (RLS) enforced. Every query is scoped to the authenticated user: no user can access another user's data.
OAuth tokens for connected email accounts are encrypted with AES-256 before storage. Database backups are encrypted. Stripe handles all payment card data: we never see or store card numbers.
All connections use TLS 1.2+ (HTTPS). Data between your browser, our servers, and third-party services is always encrypted in transit.
User authentication is handled by Supabase Auth with secure, httpOnly cookies. Passwords are hashed with bcrypt. Google OAuth is supported for passwordless login.
We connect to your Gmail or Outlook via OAuth 2.0: we never ask for or store your email password. You can revoke access at any time from your email provider's security settings or from ChaseNudge.
Payments are processed entirely by Stripe, a PCI DSS Level 1 certified payment processor. ChaseNudge does not store, process, or transmit credit card information.
Admin access to infrastructure is restricted and requires multi-factor authentication. Database access uses service role keys that are stored as encrypted environment secrets.
Each user's data is logically isolated via Supabase Row Level Security policies. API routes verify authentication before any data access.
All API keys, tokens, and secrets are stored as encrypted environment variables in Cloudflare Workers: never in source code or client-side bundles.
We only share data with services necessary to operate ChaseNudge. Each has appropriate data protection agreements in place.
| Service | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication | EU (Frankfurt) |
| Cloudflare | Hosting, CDN, DDoS protection | Global (SCCs in place) |
| Stripe | Payment processing | US/EU (PCI DSS Level 1, SCCs in place) |
| Google (Gmail OAuth) | Email sending on user's behalf | US (EU adequacy decision) |
| Microsoft (Outlook OAuth) | Email sending on user's behalf | US/EU (SCCs in place) |
If you have security concerns or want to report a vulnerability, contact us at adam@chasenudge.com