Security

How We Protect Your Archive

Last updated: August 2026

1. Encryption

Your data is encrypted at rest and in transit.

At rest: Supabase encrypts all data at rest using AES-256 encryption. Your voice recordings, photographs, and deposits are stored in private storage buckets, not publicly accessible under any circumstances.

In transit: All data transmitted between your devices and Basalith uses TLS 1.3 encryption. No data travels unencrypted.

2. Access Control

Only designated people can access your archive.

  • ·Archive owners: Authenticated via bcrypt-hashed passwords with 12 salt rounds, the same standard used by banks.
  • ·Contributors: Authenticated via 64-character cryptographically random tokens generated using crypto.getRandomValues, not guessable by brute force.
  • ·Database isolation: Row Level Security is enforced on every table at the database level, not just the application level. Even a misconfigured application cannot access data across archive boundaries.
  • ·No shared access: Your archive data is never visible to other archive owners, contributors of other archives, or Basalith employees in the normal course of operations.

3. Cloud Infrastructure

Basalith processes data on cloud infrastructure. We are transparent about this.

Where your data lives:

DatabaseSupabase (PostgreSQL on AWS)
File storageSupabase Storage (AWS S3)
Offsite backupBackblaze B2
ApplicationVercel (AWS/GCP edge network)
AI processingAnthropic API
TranscriptionOpenAI Whisper API

Each platform has its own security certifications (SOC 2, ISO 27001).

Anthropic does not train on API data by default. Your deposits and entity conversations do not improve Anthropic’s general models.

Voice and video recordings are sent to OpenAI for transcription. This covers voice recorded in the portal and the iOS app, deposits left on the phone line, and video you upload. Video is sent as a complete file and transcribed from its audio. The spoken language is detected automatically. Transcription is the only use. No other archive content is sent to OpenAI.

For enterprise clients with specific data residency requirements contact enterprise@basalith.ai

4. Multi-Factor Authentication

Coming Q3 2026.

Multi-factor authentication for archive login is on our roadmap. Until MFA is available:

  • ·Use a unique, strong password for your Basalith archive.
  • ·Do not share your password with anyone except designated Legacy Guide contacts.
  • ·Contact us immediately if you suspect unauthorized access.

Security concerns: security@basalith.ai

General privacy questions: privacy@basalith.xyz