The specifics, not a marketing paragraph.

• Row-level security by default

  Every table that carries account data is behind Postgres row-level security. Every read and write is checked against the requester’s identity by the database, not by the client. Policies are versioned in the migrations directory and audited by Supabase’s own security advisor on every deploy.

• Records that follow the animal

  The pet passport is filed against the household, not against any business. A business can read only what the household has granted to that business, and can never see what other businesses have. Every read is logged where it matters.

• Payment processing and seller transfers

  A payment provider processes checkout. The proceeds do not enter a Petworking bank account; after fulfilment and the applicable release window, Petworking instructs the provider to transfer the business’s share. Refunds and disputes follow the provider’s rules and the applicable transaction terms.

• Auth methods without a password by default

  Sign-in offers Apple, Google, email link, phone and username, all at equal weight. Password support exists because some people prefer it; leaked-password protection is on for that path so a known-compromised password cannot be used.

• Signed one-click actions

  Email actions (unsubscribe, preferences, invitation acceptance) travel as HMAC-signed tokens with a fixed expiry. Nothing about an account is changed by clicking a link that fails to verify. The visitor lands on a friendly error and the underlying record is untouched.

Reporting a vulnerability

Email kandi@petworking.pet with a description of the finding and enough detail to reproduce it. We reply within one business day and thank you in writing when the fix ships.

For legal terms, see acceptable use and privacy.