Security

GroupDex, a product by Bob Van Labs owned and operated by Bob Van LLC, stores private family directory data, so security is part of the product design. The app uses authenticated access, group-scoped authorization, role checks, rate limiting, security headers, and import staging to reduce the chance of accidental or unauthorized disclosure.

• Users authenticate through Supabase Auth.
• Private API routes re-check the authenticated user and group membership.
• Admin-only actions require owner or admin role checks.
• Groups are isolated; application code should not query across groups.
• Unclaimed person records can exist before they are linked to a user account.

GroupDex uses essential authentication/session storage only. The server session cookie is HTTP-only, Secure in production, SameSite=Lax, and scoped to the GroupDex app. The browser session is maintained by Supabase for the signed-in web experience.

• Application hosting is provided by Vercel.
• Authentication and database services are provided by Supabase.
• Payment information is handled by Stripe; GroupDex does not store full card numbers.
• Transactional email is handled by Resend.
• SMS, when used, requires explicit recipient consent.
• Import data is staged first and is not shared until the user commits it.

GroupDex sets common web security headers, including Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

Please report suspected vulnerabilities to security@groupdex.app. Include the affected URL, a description of the issue, reproduction steps, and any relevant screenshots or request IDs.

Do not access, modify, delete, or export another user's data. Do not run destructive tests, denial-of-service tests, spam, social engineering, or automated high-volume scans. We will make a good-faith effort to review responsible reports promptly.

See the Privacy Policy, Terms of Service, and Cookie Policy for additional details.