Security at FloodWatch
We take the security of your data seriously. Here's how we protect your organisation's information at every layer.
Encryption
All data is encrypted both at rest and in transit. Our database layer (Supabase/PostgreSQL) encrypts stored data using AES-256, and all connections are secured with TLS 1.2+ — including API calls, dashboard access, and webhook deliveries.
Authentication
We support multiple authentication methods to suit your organisation's needs:
- Email & password — with configurable password policies and account lockout
- Google OAuth — sign in with your Google Workspace account
- Microsoft OAuth — sign in with your Microsoft / Azure AD account
- SAML 2.0 SSO — connect your corporate identity provider (Azure AD, Okta, OneLogin, and more)
- TOTP MFA — time-based one-time password for an additional layer of security
Authorisation
FloodWatch implements defence-in-depth authorisation at both the application and database layers:
- Row Level Security (RLS) — enforced on all database tables, ensuring users can only access data belonging to their organisation
- Role-based access control — four roles (Owner, Admin, Member, Viewer) with granular permissions for team and data management
Audit Logging
Every security-relevant action is recorded in an append-only audit log. This includes all membership changes (invitations, role changes, removals), SSO configuration updates, and organisation settings modifications. Audit logs are immutable and available to organisation admins.
Compliance & Data Residency
FloodWatch infrastructure is hosted in the UK/EU region (AWS eu-west-2, London) via Supabase, keeping your data within UK and EU jurisdictions. We are building with GDPR principles in mind, including data minimisation, purpose limitation, and the right to erasure.
Infrastructure
Our stack is built on trusted, enterprise-grade platforms:
Supabase (PostgreSQL)
Managed PostgreSQL with encryption at rest, automated backups, and point-in-time recovery. SOC 2 Type II certified.
Vercel
Edge-optimised hosting with DDoS protection, automatic TLS certificates, and a global CDN. SOC 2 Type II certified.
Resend
Transactional email delivery with DKIM/SPF/DMARC authentication, TLS encryption, and EU data processing.
SOC 2 Type II
We are preparing for SOC 2 Type II certification. Our infrastructure providers (Supabase, Vercel) are already SOC 2 Type II certified, and we are implementing the organisational controls to achieve our own certification.
Data Sources & Methodology
FloodWatch uses official data from the Environment Agency (England), Natural Resources Wales, and SEPA (Scotland). Contains public sector information licensed under the Open Government Licence v3.0.
For situational awareness only.
Flood warnings: Fetched every 5 minutes from EA, NRW, and SEPA.
River level readings: Fetched every 15 minutes; source data typically updates every 15–30 minutes at the station.
Payments: All payment card details handled by Stripe — we never see or store card numbers.