Your family's property data is sensitive. We've built Dwelly on infrastructure specifically chosen for its security track record, and we follow industry best practices at every layer.
We deliberately chose hosting and database providers with strong security track records rather than building infrastructure from scratch. Here's what each provider brings to your security:
Supabase handles our database, authentication, and file storage. It runs on AWS (us-west-2) and provides row-level security, which means database access rules are enforced at the database level โ not just in our application code. Supabase maintains SOC 2 Type II compliance.
Vercel hosts the Dwelly application. Vercel provides DDoS protection, automatic HTTPS, and edge network infrastructure that keeps the app fast and resilient. Vercel is SOC 2 Type II compliant.
Stripe handles all payment processing. Stripe is a PCI-DSS Level 1 Service Provider โ the highest level of payment security certification. Your card details go directly to Stripe and never touch Dwelly's servers.
Dwelly uses Supabase Auth for account management, which supports:
Each Dwelly property is a contained data environment. Co-owners can only view and edit data within properties they have been explicitly invited to. We use Supabase's row-level security (RLS) policies to enforce this at the database level, providing an additional security layer beyond application-level access controls.
If you discover a potential security vulnerability in Dwelly, please report it to us responsibly before disclosing it publicly. We take all security reports seriously and will respond promptly.
Please email security concerns to hello@dwelly.com with "Security" in the subject line. Include as much detail as possible about the issue and how to reproduce it. We will acknowledge your report within 48 hours and keep you updated as we investigate.
We ask that you give us reasonable time to address the issue before any public disclosure, and that you do not access, modify, or delete any data that does not belong to you during your research.
Security is a shared responsibility. Here's what you can do to protect your Dwelly account:
For security-related inquiries, vulnerability reports, or questions about how we protect your data:
hello@dwelly.com โ include "Security" in the subject line
We aim to respond to all security reports within 48 hours.