Security

• • Authentication is handled by Supabase Auth (email and password)
• • Sessions use modern auth flows (including PKCE where applicable)
• • Password reset links are time-limited and delivered over email when SMTP is configured
• • Admin privileges are not available through public signup; admin role is assigned only in our database by operators
• • Admin access requires multi-factor authentication (TOTP) after password sign-in, and sensitive admin actions are recorded in an audit log

• • Traffic to the site uses HTTPS / TLS via our hosting provider
• • Application data lives in Supabase Postgres with row-level security (RLS) policies on sensitive tables
• • Files (such as course materials and resumes) are stored in Supabase Storage with bucket policies
• • Server-only secrets (for example the database service role) stay in Vercel environment variables and are not exposed to the browser
• • Data at rest is encrypted by our cloud providers' standard infrastructure controls

• • Website and APIs are hosted on Vercel
• • Database, auth, and storage run on Supabase
• • We apply security-related HTTP headers (including Content-Security-Policy) at the edge where configured

When payments are used, card processing is handled by Stripe. We do not store full payment card numbers on Our Innovation servers.

We use these providers to operate Our Innovation. They process data only as needed to deliver their services to us:

Full details also appear in our Privacy Policy — Subprocessors.

Report security vulnerabilities to security@ourinnovation.org. Include steps to reproduce and avoid accessing other users' data. We aim to acknowledge reports within five business days. For general support, use Contact or admin@ourinnovation.org.