Security at My DISC Score

Security is a shared responsibility. Moxie LLC operates the application and the controls described on this page; our infrastructure providers operate the underlying cloud platform; and account holders are responsible for protecting their own credentials and managing access within their organization.

This page describes controls that are currently enabled in the My DISC Score platform. It is maintained by Moxie LLC and is not an independent certification or audit attestation.

• Email & password sign-in, password reset via signed email link, and Google OAuth.
• New and changed passwords are screened against the Have I Been Pwned breach database; known-compromised passwords are rejected.
• Sessions are bound to short-lived bearer tokens that are refreshed automatically and revocable on sign-out.

• User roles are stored in a dedicated table — never on the user profile — and checked through security-definer database functions to avoid privilege-escalation patterns.
• Every user-facing table has Row-Level Security (RLS) enabled, with policies that scope reads and writes to the current user, their team, or their organization.
• Organization owners and admins can see results for members of their organization only. Team managers can see members of teams they manage. Regular members see only their own results.
• The last owner of an organization or team cannot be removed — enforced at the database level to prevent accidental loss of control.
• Seat, team, and member limits are enforced server-side by database triggers.

• All traffic is served over HTTPS / TLS.
• The database, file storage, and backups are encrypted at rest by our cloud provider.
• Passwords are hashed by Supabase Auth with industry-standard algorithms; we never see or store plaintext passwords.
• Service-role and admin credentials are stored as managed secrets and are accessible only to server-side code, never to the browser.

• The application runs on Cloudflare Workers, and the managed Postgres database is provided by Supabase.
• Edge delivery, DNS, and DDoS protection are provided by Cloudflare.
• Server functions run in an isolated edge runtime; secrets are injected at request time and are never bundled into the browser build.
• Database backups are managed by the cloud provider on an automated schedule.

• Transactional emails (sign-in, password reset, invitations, completed-assessment notifications) are sent through a managed broker.
• The platform maintains a per-recipient suppression list and a one-click unsubscribe channel.
• Webhooks and public API endpoints validate signatures and inputs before performing any privileged action.

• Application and database errors are logged. Aggregated metrics are reviewed regularly.
• Database schema changes are applied through versioned migrations and reviewed before deployment.
• Production deployments are gated by automated builds and type checks.

To keep your account and your organization safe:

• Use a strong, unique password (or Google sign-in).
• Do not share invitation links or join codes publicly.
• Remove members and revoke codes promptly when access is no longer needed.
• Report anything suspicious immediately (see below).

We welcome responsible disclosure. If you believe you have found a security vulnerability, please report it via the contact form with the subject line "Security report" and as much detail as you can share (steps to reproduce, impact, affected URL).

Please give us a reasonable opportunity to investigate and fix the issue before publicly disclosing it. Do not test against accounts you do not own, and do not attempt to access data that is not yours.

This page describes the controls Moxie LLC has enabled. It is not a claim of SOC 2, ISO 27001, HIPAA, PCI, or GDPR compliance, and it is not an independent audit attestation. No system can guarantee absolute security; we work continuously to improve.