Your operation data, protected by design.
Genemap runs on Supabase (Postgres + Auth + Storage + Edge Functions) with row-level security enforced everywhere. Producer operation data is isolated by account. Genemap does not aggregate data across farms.
Row-level security
Every Supabase table has RLS policies. A producer's user_setup, slaughter outcomes, and catalogue uploads are only ever readable by that producer's authenticated session. No service-role-key escape hatches in the client.
No cross-farm aggregation
Genemap does not aggregate data across farms. If that ever changes, the minimum bucket size will be 5 producers, and nothing below that will be published.
Encrypted in transit and at rest
TLS 1.3 between client and platform. Postgres data encrypted at rest in Supabase managed storage. Edge Function secrets vaulted and never logged.
AI translator scope
The Claude-backed evaluation translator only ever sees the raw breed-society trait code, value and units. Your operation data, location, herd records, costs and producer identity are never sent. Anthropic does not retain inputs sent via API.
Authentication
Supabase Auth with hashed passwords (bcrypt), session JWTs, password recovery via signed magic links. Optional MFA. SSO available on Enterprise tier.
Backups & disaster recovery
Daily Postgres backups via Supabase, kept for 7 days; a restore goes back to the most recent daily backup (point-in-time recovery is not enabled). Source code is version-controlled in a private GitHub repository, with nightly copies in two other places.
Operational practices
- Least-privilege access. No engineer has standing production database access; just-in-time access via audited Postgres roles.
- Edge Function isolation. Each function runs in its own deno worker; no shared mutable state.
- Secrets management. All API keys (Anthropic, NIWA, NOAA, USDA, MetOffice, INMET, MeteoFrance, DMI, MET Norway, KMA, Copernicus) live in Supabase Secrets Vault. Rotated quarterly.
- Dependency auditing. Weekly automated dependency review for all front-end JS and Edge Function code.
- Incident response. 24-hour disclosure window for any security incident affecting producer data, with direct email to all affected accounts.
Compliance & data residency
- Australian Privacy Principles (APP) compliance for AU producers under the Privacy Act 1988.
- GDPR-aligned data handling for EU producers (right of access, rectification, erasure, portability).
- Data residency. Default Supabase region is Australia (Sydney); EU and US regional hosting available on Enterprise tier.
What we don't do
- Sell or share identifiable producer data with third parties.
- Re-identify aggregate benchmarks back to underlying producers.
- Use producer catalogue uploads to train any model published outside the producer's account.
- Retain backups longer than 90 days after account deletion.
Please email security@genemap.com.au with details. We acknowledge within 24 hours and aim to triage and patch within 72 hours for high-severity issues. Coordinated disclosure preferred — please give us a fix window before publishing.