Security
Last updated: August 21, 2026
Sovoli uses technical and organizational controls to protect the information processed through its platform. The sections below describe the controls that are in place, organized by function rather than by vendor.
Authentication
Users authenticate using phone and email one-time-password (OTP) verification. Authenticated sessions are managed by the application, and sessions may expire or be revoked where implemented. Identity verification is based on the contact information the user provides and confirms during sign-in.
Authorization & Tenant Isolation
Access to data is determined by account permissions. Organization data is scoped to the appropriate tenant, and users are only permitted to access records authorized for their role or account. Application-level authorization checks protect organization-specific resources, so possession of a URL alone should not grant access to protected information.
Encryption
Data in transit is protected with TLS/HTTPS. Data at rest is protected by the encryption provided by managed database and media infrastructure used by Sovoli.
Private Files & Media
Public media may use public delivery URLs where intentionally public. Private assets use authenticated or signed access, and access checks occur before private delivery. Non-image private downloads can use short-lived URLs, and private images can use signed delivery URLs.
Infrastructure & Environment Separation
Production systems are hosted using managed cloud services, and the production database is separated from preview and development infrastructure. Secrets are provided through environment configuration, and sensitive credentials are not committed to repositories. Preview and local environments should not automatically receive complete production customer data.
Administrative Access
Production access is restricted to authorized personnel and is used only when required for operations, troubleshooting, support, security, or maintenance. Least privilege is the intended access model, and administrative access should not be used for unrelated purposes.
Logging & Monitoring
Application and security-relevant events may be logged. Logs are used for troubleshooting, service reliability, abuse detection, and security investigation. Better Stack is used for operational and security logging.
Backups & Recovery
PlanetScale manages production database backup and recovery capabilities. Cloudinary provides managed storage redundancy for media. Backups support service restoration, and backup retention is governed by provider and configured capabilities.
Secure Development
Sovoli follows practices that include source control, controlled deployments, separation of application environments, dependency and package management, secrets management, code review where applicable, and production configuration that is kept separate from code.
Security Contact
Report a security or data-protection concern: