A plain-language summary of the security controls IRES AI operates today. For the wider picture (privacy, subprocessors, retention) see the Trust Center.
Authentication
- Email/password with strong password rules; Google sign-in supported.
- Sessions signed by the auth provider; tokens rotate automatically.
- Sign-out clears the local session and the client cache.
Authorisation
- Roles per community: owner, committee (secretary/treasurer/chair), manager, auditor.
- Every database query runs under row-level security policies scoped to the caller.
- Privileged operations (invites, role grants) require a verified role, not just a login.
Data protection
- TLS 1.2+ in transit for all endpoints.
- Encryption at rest for the managed database and file storage.
- Uploaded documents are served via signed URLs; direct object access is denied.
Hosting
- Application and database hosted in the EU (Frankfurt region).
- Edge functions run on a hardened serverless runtime — no long-lived servers to compromise.
Secrets & keys
- Service credentials live in the platform secret store, never in code.
- Public keys used by the browser are scoped to safe, read-only operations under RLS.
Reporting a vulnerability
We welcome coordinated disclosure. Email security@iresai.app with a clear description and reproduction steps. Please give us a reasonable window to fix before publishing details.