Security

Our security approach

Classmade uses technical and administrative safeguards intended to protect Seller and Buyer data. No internet service can promise absolute security, so this page describes current practices rather than offering a security guarantee or certification.

Authentication and access

Seller authentication is provided through Supabase Auth. Passwords are handled through the authentication provider rather than stored by Classmade in readable form. Buyer access can use passwordless links for supported library and order flows.

Administrative and tenant access controls are enforced server-side, and tenant-owned data is scoped using PostgreSQL Row-Level Security together with application authorization checks.

Data isolation

Classmade is multi-tenant. Store-owned records are keyed to a tenant and database policies are used to restrict access between tenants. Privileged service-role paths, such as webhooks and server-side operational jobs, must scope their work explicitly because the service role bypasses ordinary Row-Level Security.

Payments

Card payments and Seller payout onboarding use Stripe. Card numbers and bank-account credentials are entered into Stripe-controlled payment or onboarding surfaces rather than stored as full payment credentials in the Classmade application database.

Files and delivery

Downloadable files are stored in private object storage and are delivered using time-limited signed links. Signed links reduce unauthorized link reuse and hotlinking, but no technical control can prevent a legitimate purchaser from making an unauthorized copy after downloading a file. The EULA and copyright rules govern that conduct.

Infrastructure and providers

Classmade currently relies on providers including Supabase for database, authentication and storage; Vercel for hosting and delivery; Stripe for payments; and Resend for email. Each provider maintains its own security and compliance program. Their current certifications and status should be checked on their official sites rather than assumed from this page.

Security reporting

If you believe you have found a security vulnerability, email hi@classmade.co with enough detail for us to understand and reproduce the issue. Please avoid accessing, changing, retaining or disclosing data that does not belong to you, and do not disrupt the service while testing.

We ask researchers to give Classmade a reasonable opportunity to investigate and address a reported issue before public disclosure. This responsible-disclosure request does not authorize unlawful access or activity.

Contact

Security reports and general support: hi@classmade.co.