OZYRA SECURITY POLICY

We design Ozyra with security in mind. This policy summarizes the technical and organizational measures we take to protect data handled by the Services.

We welcome responsible disclosure from researchers and users. If you discover a vulnerability, email ozyrachatapp@gmail.com with:

• Description and impact
• Steps to reproduce
• Relevant proofs of concept, screenshots, or logs
• Contact details for coordination

We commit to acknowledging receipt, validating the issue, and working with you on remediation. Credit is given when desired.

• Encryption in transit: All traffic between clients and our Services is protected with TLS.
• Encryption at rest: Data stored with our providers (e.g., Supabase, Vercel) uses provider-managed encryption at rest.
• Access control: Production access is limited to authorized personnel with least-privilege principles.
• Secrets management: Credentials and API keys are stored using provider secret management features.
• API key handling: User-supplied provider keys are stored locally on the device, and cloud sync stores encrypted API key material rather than plaintext keys.

• Sign-in uses Google OAuth 2.0 via Supabase Auth.
• GitHub device flow is used only when connecting GitHub/Copilot features.
• Session tokens are managed by Supabase and rotated per best practices.
• We monitor for suspicious login activity where signals are available.

• Hosting on Vercel with managed network security and DDoS protections.
• Database, auth, and storage provided by Supabase with built-in access controls.
• Rate limiting and input validation to reduce abuse.
• Dependency updates and security patches are applied regularly.
• Logging and monitoring to detect anomalies and errors.
• Content Security Policy, strict transport security, origin checks, and request size limits are used on sensitive API surfaces where practical.

• Cloud-synced data relies on Supabase-managed backups and redundancy.
• Local data is stored in IndexedDB in your browser; ensure you export or sync before clearing browser data or resetting your device.

If we detect a security incident, we investigate, mitigate impact, and take corrective actions. When required, we will notify affected users and relevant authorities.

1. Use trusted OAuth providers and enable MFA where available.
2. Keep your devices and browsers updated.
3. Do not share active sessions or export data to untrusted systems.
4. Report suspicious activity or vulnerabilities promptly.
5. Log out on shared or public machines.

We may revise this Security Policy. The "Last Updated" date reflects the latest changes. Material changes may also be communicated in-product.

For security concerns, contact ozyrachatapp@gmail.com.