Last updated · April 18, 2026
The Handover sits between your AI agents and the humans who approve what they do. That means we see action descriptions, approver emails, and your API keys. This page explains exactly how we handle each of those — the infrastructure, the storage, and what we won't do with them.
All customer data lives in a Postgres database managed by Supabase (AWS us-east-1), with encryption at rest and row-level security policies scoping every row to a single account. The API runs on Railway. Transactional email goes through Resend. Billing is handled by Polar. That's the entire footprint — we don't replicate your data to any other store, analytics warehouse, or third-party tool.
POST /auth/api-keys. Lose it and you rotate — there is no retrieval.is_active=false; every subsequent request is rejected at the auth middleware before it hits any business logic.POST /decisions with an unlisted approver returns 403 — your agent cannot email anyone not on your list.create(). If you don't send it, we don't have it.These are the third parties that process your data to make the service work:
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Supabase | Database & auth | Account, decisions, keys (hashed), audit log | AWS us-east-1 |
| Railway | API hosting | Request processing (stateless) | US |
| Resend | Transactional email | Approver email, action, context | US / EU |
| Polar | Billing | Email, subscription metadata | US |
| Slack / Cloudflare | Optional Slack delivery, CDN for assets | Only if you install Slack | Global |
Production database access is restricted to the founding team and required only for incident response. All access goes through Supabase's audit-logged console — we do not log into the database from local machines. The dashboard enforces the same row-level security as the API, so even our own support tooling can't read your decisions without going through the regular auth path.
We are an early-stage company and are honest about this: we do not currently hold SOC 2, ISO 27001, or HIPAA attestations. If your compliance program requires them, the honest answer is "not yet." We support GDPR data-subject rights (access, correction, deletion) today via support@thehandover.xyz. SOC 2 Type I is on the roadmap once we cross the usage threshold that makes it worth the audit cost; we'll update this page the day we start.
If you believe you've found a vulnerability, please email security@thehandover.xyz with steps to reproduce. We'll acknowledge within two business days. Please don't test against other customers' data or run load that degrades service — we'll work with you in good faith if you do the same.
If an incident affects your data, we will notify affected customers within 72 hours by email, publish a post-mortem summarising root cause and remediation, and rotate any credentials that may have been exposed.
Procurement, security review, or anything else — email support@thehandover.xyz and we'll respond personally.