Security

Nine Pebbles is built on enterprise-grade infrastructure and follows UK-specific compliance practices for educational settings.

Hosting and data location

Your database and files are hosted in London, UK (Supabase on AWS eu-west-2), encrypted at rest. Some services we use process data elsewhere under UK transfer safeguards; see the sub-processor list. The application itself runs on Vercel's global edge with primary compute close to UK users.

Authentication

• Email + password, magic-link sign-in for parents
• WebAuthn / biometric quick-unlock for parents on mobile
• Two-factor authentication (TOTP) supported and required for organisation owners
• Sessions are httpOnly + secure cookies; refresh on every request

Authorisation

• Row-Level Security on every Postgres table — no shared-pool reads
• Multi-tenant isolation by organisation_id + centre_id
• Granular roles: owner / admin / manager / tutor / teacher / reception / parent

Data retention

Configurable per centre. Defaults follow UK ICO guidance: 25 years for safeguarding, 7 years for financial, 3 years for attendance and lesson notes, 2 years for marketing, 1 year for email logs. See your settings → retention.

Backups + recovery

Daily backups retained for 30 days. Point-in-time recovery available on Pro tier. RPO ≤ 24 hours, RTO ≤ 4 hours documented.

Payment data

Card numbers never touch our servers — Stripe + GoCardless handle PCI scope. Direct Debit mandates use UK BACS. Refund execution runs through audited routes only.

Encryption

• TLS 1.2+ everywhere (HSTS preload set)
• AES-256-GCM for per-centre PSP credentials (additional authenticated data binding)
• Database-at-rest encryption via Supabase / AWS RDS

Monitoring

Sentry error tracking with PII scrubbing. Audit log for every create / update / delete on tenant data, retained per the centre's retention policy. Webhook deliveries logged and replayable.

Vendor list

• Supabase (Postgres + storage + auth)
• Vercel (hosting + edge)
• Stripe + GoCardless (payments)
• Resend (transactional email)
• Sentry (error monitoring)

Reporting a security issue

Email [email protected]. We aim to triage within one business day. Responsible disclosure honoured.