Security at WindowEdge

Infrastructure

WindowEdge runs entirely on Google Cloud Platform and Supabase. We operate no servers of our own and no physical data center. Our production services run on Google Cloud Run in the United States (us-west1), and our database is a managed PostgreSQL instance hosted by Supabase.

Both providers maintain their own independent audit reports covering the physical and platform layers we build on.

Data Separation

WindowEdge is multi-tenant. Every dealer's data is isolated by PostgreSQL Row Level Security, enforced in the database itself rather than in application code. A query carrying one dealer's credentials cannot return another dealer's rows, even if application logic were wrong.

Encryption

Data is encrypted in transit and at rest. All traffic to our web applications and APIs uses TLS. Database connections require TLS, and connections that do not negotiate encryption are rejected.

Data at rest is encrypted by our cloud providers using industry-standard algorithms.

Access Control

Access to production systems is limited to named individuals, reviewed periodically, and removed when someone leaves. Administrative access requires multi-factor authentication. Application access is governed by role, and staff see only what their role requires.

Change Management

Every change to WindowEdge goes through version control and automated testing before it can reach production. Production releases require a pull request against a protected branch with required status checks that no one can bypass, including administrators. Every production deployment is recorded with its commit, author, and originating change.

Monitoring

We log application and infrastructure activity centrally and alert on production errors. Dependencies are scanned continuously against published vulnerability advisories, and container images are analyzed for known issues.

Reliability

Our database is backed up by our provider with point-in-time recovery. Our services run on managed infrastructure that scales automatically and restarts unhealthy instances.

Reporting a Vulnerability

If you believe you have found a security vulnerability in WindowEdge, we want to hear from you.

Email [email protected] with enough detail to reproduce the issue. We will acknowledge your report within three business days.

Questions

Dealers evaluating WindowEdge can request our security documentation through their account representative, or reach us directly: