Security at mikum.me

This page describes the security controls behind mikum.me and the service providers we rely on. If you are reviewing us as a vendor, this is the short version; write to support@mikum.me for anything it doesn't answer.

Where your data lives

• Your account, guides and photos are stored with Supabase, in its EU (Stockholm) region.
• The website runs on Vercel, served over HTTPS only. Every connection to mikum.me is encrypted in transit.
• Data stored by Supabase is encrypted at rest by the provider.
• Some providers below (for example payments, SMS and analytics) process data in other countries, including the United States. See the privacy policy for details.

Signing in

• There are no passwords to leak or reuse. You sign in with a one-time link or code sent to your email or phone, or with Google or Apple.
• Sign-in links are single-use and expire.
• Sessions are managed by Supabase Auth. Support can sign you out of every device if one is lost.

Your guides and who can see them

• Database access rules (row-level security) scope every guide, directory and setting to the account that owns it. Another signed-in user cannot read or change them.
• A published guide is public to anyone with its link, including its photos. That is how it works without an app. Unpublish a guide and the link stops working.
• Don't put anything in photos or text that you wouldn't show a visitor. Use protected codes for anything secret.

Gate and door codes

• A code you mark as protected is never included in the guide page. It is fetched from our servers only after the check you chose passes: your approval, a QR sticker on site, or the visitor's location.
• The check runs on our servers, not in the visitor's browser.
• An approval you grant expires after a few hours rather than unlocking the code forever.
• QR stickers carry a long random token that cannot be guessed.

💡Location checks rely on the location the visitor's phone reports, which can be faked. For doors where that matters, use approval or a QR sticker.

Payments

Card details go straight to Stripe and never touch our servers. We keep only a Stripe reference to your subscription.

Staff access

• Only named staff accounts can open our internal console, and each role (support, finance, admin) can do only what that role needs. Permissions are checked on the server for every action.
• Staff actions are recorded in an audit log.
• When support edits a guide for you, that access is time-limited and logged.

Protecting the service

• Rate limits on sign-in, SMS, AI and other sensitive endpoints slow down abuse and brute-force attempts.
• Messages from our providers (payments, SMS, email, support chat) are only accepted when they carry a valid signature or secret.
• Server-side image fetches are restricted to our own storage, so they can't be pointed at other systems.
• Browser security headers stop most pages from being embedded in other sites (clickjacking) and limit camera and location use to mikum.me itself.
• Dependencies are kept current, and security fixes are applied when they are released.

Analytics and AI

• Product analytics (PostHog) mask everything typed into forms and any revealed code. Pages whose link is itself private (approvals, gift claims, sign-in links) are never recorded. A browser "Do Not Track" signal turns analytics off.
• When you use an AI-assisted feature, the photos, frames or text involved are sent to Anthropic for processing. Nothing is sent unless you use such a feature.

Deleting your data

Delete a guide and its photos are removed from storage. Delete your account from Account settings and every guide, photo and record goes with it. See Privacy and your data.

Service providers we rely on

Each link goes to the provider's own security or trust page, where you can find their certifications and reports.

• Supabase: database, sign-in and file storage. Security
• Vercel: website hosting. Security
• Stripe: payments. Security
• Twilio: SMS and WhatsApp messages. Trust center
• Resend: transactional email. Security
• Anthropic: AI-assisted features. Trust center
• Upstash: rate limiting. Trust
• PostHog: product analytics. Security
• MapTiler, OpenStreetMap and Google Maps Platform: maps and address lookup. MapTiler privacy
• Google and Apple: optional sign-in.

Report a security issue

Found something? Email support@mikum.me with the details. We read every report and will tell you what we did about it.