Security

Last updated: June 2026

Security is foundational to Thozia. We are building a platform that organisations trust with sensitive governance data, and we take that responsibility seriously.

Infrastructure

Thozia is hosted on Supabase (PostgreSQL) in the Sydney region (ap-southeast-2) for New Zealand and Australian customers. All data is encrypted at rest and in transit using industry-standard TLS 1.2+.

Authentication

User authentication is handled by Supabase Auth with bcrypt-hashed passwords. Row Level Security (RLS) is enforced at the database level — users can only access data belonging to their own organisation.

Browser extension

Content is analyzed transiently, on-device, to classify task type. Raw prompt and response text is never stored and never transmitted — only the resulting classification label leaves the device. The extension also transmits anonymised category data (tool domain, session duration, task category). No prompt or file content leaves the browser.

Data minimisation

We collect only what is necessary to provide the Service. AI prompt content is never collected, stored, or transmitted. Usage signals are aggregated and anonymised before storage.

Access controls

Internal access to production data is restricted to authorised personnel only. All access is logged. We follow the principle of least privilege across all systems.

Vulnerability disclosure

If you discover a security vulnerability in Thozia, please report it responsibly to admin@thozia.com. We will acknowledge your report within 48 hours and work to resolve confirmed issues promptly.

Contact

For security enquiries: admin@thozia.com

This page will be updated as our security posture evolves.