Security
Last updated:
Ilnami stores private memories, so security isn’t an extra. This page only describes what it does today and, wherever possible, an automated test keeps watch.
Row-level security on every table
The database applies row-level security (RLS) to all of its tables: every query returns only what is yours or what someone has shared with you in a circle. An SQL probe in continuous integration fails if any table is left without RLS or with excess permissions.
Session and password
Your session travels in httpOnly cookies, which the page’s JavaScript cannot read, with SameSite=Lax and Secure in production. Passwords are handled by Supabase Auth, which only stores their hash.
Content policy with a nonce
Every page carries a Content Security Policy (CSP) with a fresh nonce on each request: the browser only runs scripts that carry it. We also send HSTS, X-Frame-Options, nosniff, Referrer-Policy and Permissions-Policy, and requests that change anything check their origin.
Rate limits and validation
Server actions go through a sliding-window rate limit that blocks rather than lets traffic through if its store doesn’t respond. Every parameter is validated against a schema (Zod) before it is used.
No session recording
We don’t record what you do on screen. Error reports don’t carry your email address, your IP or the content of your memories, and analytics only load if you accept them.
Where your data lives
The database, authentication and photos are hosted by Supabase in the European Union (Frankfurt), encrypted in transit and at rest. Which other providers are involved, and why, is set out in the Privacy Policy.
You’re in control
From Profile you can download all your data as JSON and delete your account and everything in it.
Reporting a vulnerability
If you find a vulnerability, write to hola@ilnami.com with the steps to reproduce it. Please don’t access other people’s data or degrade the service while checking it, and give us time to fix it before making it public. The same address is in security.txt.