Zuletzt aktualisiert: 20 August 2026
Transport encryption
All traffic is encrypted with TLS 1.3. HTTPS is enforced via HSTS. TLS termination happens at the Cloudflare edge.
Authentication & sessions
Sign-in via email + password, Google or Apple. Passwords are stored as salted hashes only. Sessions are short-lived JWTs with automatic refresh and revocation.
Data access & row-level security
Every table is protected by row-level security. Users can only read and modify rows where user_id = auth.uid(). Server-side checks complement client-side constraints.
Storage & image uploads
Uploaded images live in the private storage bucket drops. No public direct access. Display uses signed URLs with a 1-hour TTL. Deleting a drop removes the associated file automatically.
Agent API keys
User-generated API keys are stored server-side as an irreversible cryptographic hash only; the plaintext secret is shown once at creation. Keys can be rotated or revoked at any time.
Push messages
Push payloads are end-to-end encrypted per Web Push (RFC 8291). The provider cannot read payloads in transit.
Rate limiting & abuse detection
The agent API and auth endpoints are rate-limited. Suspicious patterns (login brute force, excessive API use) are automatically blocked.
Backups & recovery
The production database is backed up daily (point-in-time recovery of the managed provider). Backups live in the same EU region.
Responsible disclosure
Found a vulnerability? Please report it confidentially to drop-in@cherry-drop.io with subject “Security”. We acknowledge receipt within 72 hours.