Security

Last updated: October 21, 2026

How Hapitalist is built and how your account and your work are protected - what we actually run today, nothing aspirational. If you think you have found a security problem, write to support@hapitalist.com and we will look at it straight away.

Where things run

Part	What runs it
The website and app pages	Static pages served by Netlify, over HTTPS only (browsers are told never to use plain HTTP for this site).
Your account and everything you save	A Postgres database run by Supabase, hosted in the United States (AWS, Northern California).
Signing in	Supabase Auth: a password or a one-time sign-in link sent to your email. Passwords are stored only as salted hashes; nobody at Hapitalist can see yours.
Work done on the server	Supabase Edge Functions. Anything that touches an account checks who is signed in first.
Payments	Stripe. You pay on Stripe's own page; your card number never reaches our servers.
Coach Joy and the AI tools	Anthropic, Groq and OpenRouter (see below).

Your data is walled off

Row-level security on every table. The database itself checks every read and write against the account that is signed in, so a member can only see their own journal, tools, chats and saved work. This is switched on for every table in the database, not just the ones we remembered.
The pages hold no secrets. The only key in the pages your browser loads is the public one, which can do nothing the row-level rules do not allow. The keys for payments, email and AI providers live in an encrypted vault on the server and are never sent to a browser.
Things you choose to share are the only things others see - messages in community rooms and cohorts, for example. Your private entries are never shown to other members.

AI

When you use Coach Joy or an AI tool, what is needed for that answer is sent to the model provider (Anthropic, Groq, or OpenRouter, which routes to the model that double-checks Joy's answers) and the answer comes back. Providers process it only to answer you.
We do not train any AI model on your work, and we do not hand your work to anyone to train theirs. The full commitment is in section 6a of the Terms of Service.
If you add your own AI provider key, your requests use that key and that provider's terms.

Watching for problems

A set of automated checks runs around the clock and flags anything that would open data up - a table without its row-level rules, a server function callable by the public that should not be, a payment or sign-in path that stops working.
Every change to the website's pages goes through our code repository and is published from there, so we can see what changed and put it back.

What you can do

Use a strong password, or sign in with email links, and do not share your account.
Sign out on shared computers - it removes the sign-in cookie (see the Cookie Policy).
You can delete your entries or your whole account; how we handle your information is in the Privacy Policy.