Data & Security Summary

1. Service architecture

Sage Confirmation is a web application hosted on Railway. Supabase provides authentication and database services. Cloudflare is used for the production domain, proxy and related edge-security services. Google Workspace is used for business email and support communications.

The beta does not require a Sage API connector or mailbox integration. Purchase-order data is imported from CSV/XLSX files and supplier confirmations can be imported from CSV/XLSX or, optionally, processed through the PDF Beta.

2. Authentication and access

Customer access uses Supabase email/password authentication with cookie-based sessions. Protected server actions and authenticated pages verify the signed-in user before accessing customer data.

Customer workspaces are not public. Anonymous database access to the application tables is revoked, and authenticated access is constrained by database row-level security policies.

3. Customer data isolation

Each workspace has an authenticated owner. Row-level security policies restrict workspace access to that owner and carry the same ownership check through purchase orders, purchase-order lines, supplier confirmations and confirmation lines.

This means the application does not rely only on page-level filtering to separate customers; the database also enforces the workspace ownership boundary.

4. File and purchasing-data handling

CSV and XLSX imports are processed by the application to create structured purchase-order or supplier-confirmation records. The current beta is a confirmation-checking workflow, not a general document-management or file-archive system.

The structured records required for the workflow are stored in the application database, including purchase-order and confirmation references, line identifiers, part numbers, quantities, prices, units, dates and workflow status where applicable.

5. Optional AI-assisted PDF extraction

AI processing is optional. If a user chooses the PDF Beta, the selected supplier-confirmation PDF is sent to the OpenAI API for structured extraction. The application requests store: false for that API call.

The extracted values are shown to the buyer for human review before import. The AI step does not decide whether the confirmation matches the purchase order; the subsequent comparison is deterministic.

See the Privacy Notice for more detail about provider data handling and retention.

6. Transport and browser-facing protections

The production service is served over HTTPS. The application also sends baseline security headers including HTTP Strict Transport Security (HSTS), MIME-type sniffing protection, frame blocking, a restricted referrer policy, and permissions restrictions for camera, microphone and geolocation.

7. Application secrets and privileged access

Browser-facing Supabase configuration uses a publishable key. Privileged service-role credentials are not required by the current application flow. Server-side secrets, including the OpenAI API key used for optional PDF extraction, are supplied through the deployment environment rather than exposed in browser code.

8. Data minimisation and beta scope

Sage Confirmation is intentionally narrow. It stores and processes the purchasing information needed for confirmation checking and buyer follow-up rather than attempting to replicate a full ERP, mailbox or document repository.

Customers should avoid uploading unrelated personal, confidential or sensitive information that is not needed for the purchasing workflow.

9. Service providers and data protection

Current providers relevant to the Service include Railway, Supabase, Cloudflare, OpenAI and Google Workspace. Their role and the handling of personal data are described in the Privacy Notice.

A data-processing agreement can be discussed where a customer requires one for the paid beta.

10. Reporting a security or privacy concern

Contact [email protected] with a security or privacy concern related to Sage Confirmation. Please include enough detail for SoftBox to investigate, but do not send passwords or other authentication secrets by email.

11. Supplier details

SoftBox
Business ID: 1034495-8
Aittoniementie 67
12750 Pilpala
Finland