Security and trust center

Infrastructure

Hanory does not run on a server in someone's back room. It runs on managed infrastructure from specialist providers that undergo independent audits, so server patching, physical security and hardware failures are handled by teams who do this full time.

• Hosting and delivery: Cloudflare. The website and app are served from Cloudflare's global network. The site only loads over HTTPS, so all traffic between your browser and Hanory is encrypted. An HSTS policy tells your browser to use only encrypted connections to Hanory for two years after your first visit.
• Database, sign-in and file storage: Supabase. A managed PostgreSQL database runs in the European Union, in the Frankfurt (Germany) region. Supabase states that customer data is encrypted at rest with AES-256 and in transit with TLS (Supabase security page).
• Browser security headers. Every response tells your browser to apply strict rules: a Content Security Policy only allows scripts from Hanory, the Paddle checkout and Google's consent-gated measurement tags; Hanory cannot be embedded inside other sites (protecting against clickjacking); the browser does not guess file types; only our domain name is shared when you follow a link elsewhere; and camera, microphone and location access are switched off.
• Least privilege. Server-side functions run with only the permissions they need. Sensitive functions can only be executed with a service key that lives on the server and is never sent to your browser. The app itself only uses the public key, whose access is limited by database rules.

Data and access

In Hanory every product, document, bill and subscription belongs to a home. Who can see what is decided not just by the app's interface, but directly in the database through Row Level Security policies.

• An account can only read records of the homes it is a member of, and can only change records in homes where it has edit rights.
• Because the database enforces this rule, another home's records stay out of reach even if the app had a bug or someone tampered with a request.
• The database is backed up automatically every day (Supabase Pro daily backups), so records can be restored after a failure.

Documents

Files you upload — warranty cards, receipts, product photos — are stored in a private Supabase Storage bucket that is not publicly accessible.

• Files have no public address. When you open a document in the app, a signed link is generated just for that moment and expires after 1 hour. Even if the link is copied somewhere, it soon stops working.
• Storage is protected by the same per-home rules: only members of a home can view its files, and only members with edit rights can add or delete them.
• Only JPG, PNG, WEBP and PDF files are accepted, up to 10 MB each.
• When you delete a product or your account, the documents and photos uploaded for it are deleted from storage too.
• Important: uploaded files are not included in the daily database backups. We recommend keeping the originals of important documents (or the PDF copies you received by email) and exporting your records regularly.

Account security

• Sign-in is handled by Supabase Auth. Your password is stored only as a one-way hash; nobody, including us, can see it in plain text.
• Passwords that have appeared in known data breaches are rejected (leaked-password protection is on). Passwords must be at least 8 characters.
• When you sign up with email, you must confirm your email address before using the account.
• You can optionally use "Sign in with Google". It runs through Hanory's own Google OAuth client, and your Google password never reaches Hanory.

Tips for you

• Use a strong, unique password. Pick a long password you use nowhere else; a password manager makes this easy.
• Sign in with Google. If your Google account has 2-Step Verification on, your Hanory sign-in benefits from it too.
• Sign out on shared devices. If you used a shared computer or tablet, sign out from Settings > Your account when you are done.
• Never share your password. Hanory will never ask for your password by email or phone.

Payments

Hanory Plus payments are processed by Paddle, our authorized reseller and Merchant of Record. You enter your card details in Paddle's checkout; your card number never reaches Hanory's servers and is never stored by us.

Hanory only receives information such as subscription ID, plan and status through Paddle's signed notifications (webhooks). Each notification's signature is verified with a secret key, and notifications that fail verification or are older than 5 minutes are rejected.

Email and notifications

• Account confirmation, password reset and daily reminder digests are sent through Resend from its European Union (Ireland) sending region.
• Every reminder email includes a one-click unsubscribe link, and your email app may show an unsubscribe button directly. Your in-app reminders are not affected.
• We never send marketing emails without your consent.

Cookies and analytics

• Google Analytics only loads if you accept it in the cookie banner; if you do not, it never runs.
• According to Google, Google Analytics 4 does not log or store IP addresses. Ad personalization is disabled and your data is never sold.
• You can change or withdraw consent at any time in the app under Settings > Cookie preferences. The list of cookies is in the privacy policy.
• Your browser's local storage keeps your session, language and cookie choice; these are required for the app to work.

Your rights over your data

• Export: download your records as JSON, CSV or PDF from Settings at any time.
• Delete: delete your account from Settings. Records and uploaded files (documents and photos) are deleted immediately and removed from technical backups within 30 days.
• GDPR and KVKK (Turkish data protection law, Art. 11) requests: for access, correction, erasure, objection and your other rights, write to destek@hanory.app; we reply within 30 days. The data controller is Tolga Deveci. Details are in the privacy policy.

Sub-processors

We work with the following providers to run Hanory. Each one processes data only for its own task.

Transfers outside Türkiye are necessary to provide the service and are based on the standard contracts provided for in KVKK Art. 9. Countries and safeguards are listed in the privacy policy.

Independent audits of our providers. These certifications belong to the providers, not to Hanory, and each is published on the provider's own official page: Supabase SOC 2 Type 2 and ISO 27001 (supabase.com/security); Cloudflare SOC 2 Type II (Cloudflare SOC 2) and ISO 27001 (Cloudflare ISO certifications); Resend SOC 2 Type II (resend.com/security).

Reporting a vulnerability

If you believe you have found a security vulnerability in Hanory, please email guvenlik@hanory.app. Reports go straight to Hanory's developer. This contact is also published in our standard security.txt file.

• What to include: the affected page or feature, step-by-step reproduction, the possible impact and how we can reach you. A screenshot or short video helps a lot.
• Response time: we respond within 5 business days and keep you updated while we fix the issue.
• Please: only test with your own account and your own test data; do not access, modify or delete other people's data; do not run load tests or denial-of-service (DoS) attempts; do not use spam or social engineering; and give us reasonable time to fix the issue before disclosing it publicly.
• We do not run a paid bug bounty at the moment; we are grateful for reports made in good faith and within these rules.

Responsible honesty: what we do not claim

Trust comes from openness, not hype. So here are our limits too:

• Hanory itself has not had an independent security audit yet. The SOC 2 and ISO 27001 certifications above belong to our infrastructure providers, not to Hanory.
• Hanory does not offer end-to-end encryption. Your data is encrypted in transit with HTTPS and Supabase encrypts data at rest, but the service needs to be able to read your data on the server side to work. We only process your data to provide, protect and back up the service.
• We do not offer two-factor authentication (2FA) yet. For extra protection, sign in with a Google account that has 2-Step Verification enabled.
• Uploaded files are not included in the daily database backups. Keep the originals of important documents.
• Hanory is a small, independent service. We do not have enterprise structures such as a 24/7 security operations centre, which is why we build on specialists' managed infrastructure and on rules enforced in the database itself.
• No system can guarantee absolute security. If a breach affecting your personal data occurs, we will notify you and the relevant authority as required by the GDPR and KVKK.

Frequently asked questions

Last updated: 12 October 2026. Questions: destek@hanory.app · security reports: guvenlik@hanory.app.