Security

Last updated 27 October 2026

In short

Your data is kept in the United States by Supabase and Cloudflare, and encrypted at rest and on every connection.
The database itself decides who may read and change what, on every request, not only the screens riwer shows.
riwer has no passwords to leak, and never sees a card number.
The database is backed up every day, and each backup is kept for 7 days.
If a breach touches your data, you hear from us without undue delay.

Where your data is

Accounts, projects, documents and conversations: Supabase, on Amazon Web Services in the United States (Northern California).
Files and pictures added to projects: Cloudflare R2, in the United States. Some files added before 13 October 2026 are still in Supabase’s storage, in the same region.
The app and its server: Vercel.

Every service that handles personal data for riwer, with what it holds, is on the sub-processors page.

Encryption

Every connection — to the app, its server, the database and the file storage — is encrypted (HTTPS, TLS).
Supabase encrypts the database and its backups at rest (AES-256). Cloudflare encrypts every stored file at rest.
A file is uploaded and downloaded through a link riwer’s server signs for that one file, after checking that you may have it. An upload link works for 10 minutes, a download link for an hour.

Who can see what

In riwer: a project’s documents and conversations are seen only by its members, and a private document only by its owner. These rules, with each plan’s limits, are kept by the database itself (row-level security in Postgres), so they hold for every request made to it, however it is made.
The keys that pass those rules stay on riwer’s server, for the few jobs that need them — payment notices from Paddle, the daily clean-up of unused files, deleting an account. They never reach a browser.
At riwer: only the founder can open production data, through the providers’ own consoles, and only to run the service: to answer a request you make, to fix a fault, or when the law requires it.

Signing in and paying

You sign in with a one-time link sent to your email, or with Google or Apple. riwer asks for no password, so it holds none.
Team is paid through Paddle, riwer’s reseller. Card details go to Paddle, which is certified to PCI DSS Level 1; riwer never sees them.

Backups and deletion

Supabase backs up the database every day and keeps each backup for 7 days.
Stored files are copied every day to separate backup storage. A copy of a file deleted or changed is kept for 7 days, then removed.
A document, project or account you delete is deleted at once. Its copies in the database’s backups are gone within 7 days, and its files are removed by a daily clean-up within about a week.

If something goes wrong

If a breach affects personal data riwer holds, we tell the customers affected without undue delay — within 48 hours, as the Data Processing Agreement says — with what we know and what to do, and more as we learn it. Where we are responsible for the data, we also tell the authorities within 72 hours: the Personal Data Protection Board in Türkiye and, where the GDPR applies, the supervisory authority.

Found a weakness in riwer? Write to support@riwer.io with “Security” in the subject. Please give us a fair chance to fix it before telling others; we will keep you posted.

Certifications

riwer has no certification of its own, such as SOC 2. The services it runs on have theirs: Supabase, Vercel and Cloudflare are audited to SOC 2, Cloudflare is also certified to ISO 27001, and Paddle to PCI DSS Level 1. Their reports are available from them. For a security questionnaire, write to support@riwer.io.

Questions? support@riwer.io · Privacy · Terms · Refunds · Acceptable use · Sub-processors · Cookies · DPA · KVKK · Back to riwer