Security

Last updated July 13, 2026

Meno holds some of the most personal information a service can hold: prayers, griefs, and the quiet architecture of a life. We designed for that from the first line of code. This page describes, concretely, how your data is protected.

Encryption

In transit: every connection to Meno uses HTTPS/TLS. There is no unencrypted access.
At rest: your data is stored in a managed Postgres database (Supabase) encrypted at rest with AES-256.
Passwords: handled by our authentication provider using industry-standard salted hashing. We never see or store your password.

Data isolation

Every user-scoped table is protected by database-level row security: the database itself, not just our application code, enforces that your rows are readable by your account alone. Cross-user sharing (family links) requires an accepted, unrevoked link and your explicit sharing choices, enforced at the same database level. We maintain automated isolation tests and are moving them to a separate test database before they become a required deployment check.

Operational practices

Secrets live in environment configuration, never in code, and are rotated on any exposure.
Privileged database access is restricted to server-side code paths and never reaches the browser.
Development and production currently share one database while the test environment is being separated; production data is never used for automated tests.
Sensitive content (life updates, profile facts, prayers) is never written to logs.
Authentication and generation endpoints are rate-limited.

Incident response

If we ever discover a security incident affecting your data, we will contain it, investigate it, and notify affected users promptly and plainly (what happened, what was involved, and what we are doing about it) within the timelines the law requires and sooner where we can. We will not bury it in fine print.

Responsible disclosure

If you believe you have found a vulnerability, we genuinely want to hear from you. Email hello@thedailymeno.com with the subject “Security disclosure” and enough detail to reproduce the issue. Please give us reasonable time to fix it before public disclosure, don’t access other people’s data beyond the minimum needed to demonstrate the issue, and don’t degrade the service. We commit to acknowledging reports quickly, keeping you informed, and never pursuing good-faith researchers who follow these guidelines.

How data is collected and used lives in the Privacy Policy; how government requests are handled lives in the Law Enforcement & Emergency Disclosure Policy