Our approach

Security is built into the platform, not bolted on. UrbanOS runs on enterprise infrastructure with tenant isolation enforced at the database, so each organization's data is scoped to that organization. We treat isolation as something to keep proving, not a promise to make once.

Data protection

All data is encrypted in transit (TLS) and at rest. Every organization's data is isolated, and access is scoped to that organization on every request. We hold to least-privilege access internally.

Authentication

Sign in with Google, Microsoft, email + password, or a magic link. Sessions are protected with secure, HTTP-only cookies. Sensitive keys never reach the browser.

Infrastructure

We build on Supabase and Vercel. Both publish their own security and compliance documentation, and we rely on their automated backups, monitoring and DDoS protection rather than running that layer ourselves. Payments are handled by Stripe; we never store card numbers.

Responsible disclosure

Found a vulnerability? Email kevin@urbanailabs.com with the details and we will respond promptly. We appreciate good-faith research.

Questions? Email kevin@urbanailabs.com.