Security & Trust

Accounts sign in with email and password or with Google. Passwords are hashed by our managed auth provider (never stored in plain text) and every new or changed password is checked against the Have I Been Pwned breach database — known-compromised passwords are rejected at signup and at password change.

Ribbonora enforces one account per person by email and phone number. Anonymous sign-ups are disabled. Email confirmation is required before an account is active.

Every table that holds user data has Row-Level Security enabled at the database layer. Access policies are scoped to auth.uid(), which means the database itself refuses to return another user's rows even if application code has a bug. Shared records use an explicit, revocable sharing table with expiration dates and per-recipient permissions (view/download/edit).

Sensitive fields on your profile — plan, subscription IDs, Stripe customer ID, email — are protected by a database trigger and cannot be modified by the client, only by server-verified events (payment webhooks, verified plan changes).

Uploaded files (animal photos, vet records, vaccines, registration papers, travel documents, show records, contracts, general documents) live in private storage buckets. Each file is namespaced by the owner's user ID; the storage policies allow read, upload, update, and delete only on buckets in an explicit allow-list and only when the file path matches the signed-in user. Files are never served from a public URL — every download is issued as a short-lived signed URL from our server after the request is authorized.

Ribbonora does not see or store your card number. Payments are processed by Stripe; Ribbonora receives only the subscription status, customer ID, and period end so we can gate features. Stripe webhooks are verified by HMAC signature before any account state is changed, and privileged webhook writes use a server-only key that is never sent to browsers.

All traffic to Ribbonora uses HTTPS (TLS). Data at rest — database rows and uploaded files — is encrypted by our managed hosting provider using industry-standard disk encryption. Backups are encrypted with the same controls.

Application code that runs in your browser only ever uses a public (publishable) key that respects Row-Level Security. Privileged operations run on the server, are gated behind the signed-in user's bearer token, and re-validate that token on every call. Ownership transfers, subscription changes, and plan changes all pass through server functions that verify who you are before touching the database.

You can download a PDF of any animal's full record from the animal profile page. If you cancel your subscription, you keep read/export/delete access for 7 days after the paid period ends. Account deletion removes your profile and cascades to your animals, records, files, and shared-access grants; see our Privacy Policy.

If you believe you have found a security issue, please email security@cloudforcare.com with a description and steps to reproduce. We will acknowledge within 3 business days. Please do not test against other users' accounts, do not exfiltrate data beyond what is needed to prove the issue, and give us reasonable time to fix before public disclosure.

A machine-readable contact is also published at /.well-known/security.txt per RFC 9116.

Ribbonora is responsible for the platform controls above. You are responsible for protecting your account: use a unique password, enable your email provider's 2FA, and only share records with recipients you trust. Notify us immediately at security@cloudforcare.com if you believe your account has been accessed by someone else.