Data, Privacy & Compliance

Data, Privacy & Compliance

Every platform you build — every web app, every SaaS, every client site that collects a form submission — is a data operation. You are collecting names, email addresses, phone numbers, payment information, and behavioral data on behalf of your clients and their customers. Understanding your obligations around that data is not just a legal requirement; it is a client trust requirement.

What Data You Are Actually Collecting

Start by auditing what every platform you operate actually stores. Walk through the user journey and list every piece of information that goes into a database:

• Contact forms: Name, email, phone, message content
• Account registration: Email, name, password hash, profile information
• Payment flows: Billing name, address, card metadata (if using Stripe, they handle the card numbers — but you still store transaction records and billing info)
• Analytics: IP addresses (even if anonymized), session data, behavior patterns
• Third-party integrations: If you use Mailchimp, Resend, or any CRM, the data flowing to those platforms is also in scope

Most early-stage companies dramatically underestimate the PII they are collecting because they focus on intentional data (form submissions) and miss incidental data (analytics, logs, third-party payloads).

Privacy Policy Requirements

Every website that collects any data needs a privacy policy that covers:

1. What you collect: List every category of personal data you collect
2. Why you collect it: The purpose for each category (marketing, service delivery, legal obligation)
3. How long you retain it: And what triggers deletion
4. Who you share it with: Third-party processors (Supabase, Vercel, Stripe, Resend, Clerk)
5. User rights: How users can request their data, correct it, or ask for it to be deleted
6. Contact information: Who to contact with privacy questions or requests

For Caribbean-based companies, you are not directly subject to GDPR (which is EU law) unless you have EU users. However, GDPR-aligned practices are increasingly becoming the global standard, and any client whose customers include EU residents makes you a data processor with GDPR implications.

Jamaica has the Data Protection Act (2020), which came into full effect and imposes data protection obligations on Jamaican companies. The principles are similar to GDPR: lawful basis for processing, data minimization, subject rights.

Security SOP Every Tech Company Needs

A security standard operating procedure is the set of practices your team follows consistently to prevent data breaches. At minimum:

Access control:

• Every team member should have only the access they need for their role — not admin access to everything by default
• Shared passwords must not exist. Every person who needs access to a platform or service should have their own credentials
• When a team member leaves, all their access is revoked within 24 hours

Secret management:

• No credentials in code repositories (ever)
• Production credentials managed in Vercel env, Railway env, or a dedicated secrets manager
• API keys rotated every 90 days for critical services, and immediately when compromised

Data handling:

• Client databases not accessed from personal devices unless VPN or device management is in place
• No client data sent via personal WhatsApp, personal email, or unsecured channels
• Backups configured for all critical databases (Supabase Point-in-Time Recovery if available, or manual backup scripts)

Incident response:

• Document what to do when a security incident occurs before one occurs
• Who to notify, in what order (your technical lead, affected client, then public if required)
• How to contain the incident (rotate keys, disable access, preserve logs)

Multi-Tenant Data Isolation

Your Supreme Suite platform serves multiple tenants on shared infrastructure. The most critical security requirement for multi-tenant SaaS is that tenant A cannot ever see tenant B's data. In Supabase, this requires:

1. Every table that contains tenant-specific data has a tenant_id column
2. Row Level Security policies are enabled on every such table
3. The RLS policy verifies the requesting user's tenant ID matches the row's tenant ID before allowing access
4. This is tested explicitly — not assumed to work because the policy looks correct

Skipping this creates a data isolation failure where a curious or malicious user can access other tenants' data through a direct query or API call. This is the category of security failure that ends client relationships immediately and creates legal liability.

What to Tell Clients About Data Security

When clients ask about your data practices (and sophisticated clients will), be able to answer:

• Where their data is stored (Supabase hosted on AWS, specific region)
• What encryption is in place (Supabase encrypts data at rest and in transit)
• Who has access to their data (your team members with specific roles)
• What your backup and recovery process is
• What your breach notification process is

Having written answers to these questions — even a simple one-page security overview — signals professionalism and builds the kind of trust that retains enterprise clients.