Protecting your business data is foundational to AuraSea OS. This page describes our security practices and ongoing commitments. We update this page as our practices evolve.
1. Where your data lives
Customer business data — the reports you upload and the figures you enter — is stored in a Supabase database in the Sydney, Australia region. Some tasks use providers outside that region: sending email (Resend), sending LINE messages, and writing parts of the summaries with AI (Anthropic); each receives only the data that task needs. Database backups are kept by Supabase, and the company keeps an additional copy in its own backup system for recovery.
Marketing website hosting (auraseaos.com) is provided by Vercel using their global edge network for fast delivery. The marketing site does not store customer business data.
2. Encryption
All data transferred between your devices and our servers is encrypted in transit using TLS 1.2 or higher. Data at rest in our Supabase database is encrypted using AES-256. Backups are encrypted. Passwords are never stored in plaintext; we use industry-standard hashing (bcrypt or argon2).
3. Access controls
Access to production systems is restricted to authorized AuraSea team members on a need-to-know basis. We do not access individual customer accounts except for authorized support requests, scheduled maintenance, or in response to suspected fraud or security incidents.
4. Authentication
Customer accounts sign in with email and password, and linking LINE requires confirmation both from the signed-in account and from the account owner's own LINE.
5. Your hotel's or resort's systems
AuraSea OS does not connect into your PMS or OTAs. Data comes from the reports you upload or the figures your staff enter. We never ask for your PMS or OTA passwords, and the system never changes your OTA rates by itself.
6. Incident response
We monitor our systems for security incidents. If a data breach occurs that affects your data, we will notify you within 72 hours of discovery, in line with PDPA requirements, and report to the Personal Data Protection Committee (PDPC) of Thailand as required.
7. Data deletion
When you stop using the service and ask us to delete your data, we remove your business data from our systems within 30 days, including the company's own backup copies; Supabase's backups expire on their retention cycle. Some data may be kept longer where Thai law requires it (e.g. financial records for tax). Contact hello@ratedesk.ai or LINE @auraseaos.
8. Vendor security
Our providers (Vercel, Supabase, Resend, LINE, Anthropic, Omise, Google) hold their own security certifications, such as SOC 2 and ISO 27001.
9. Reporting a security issue
If you discover a security vulnerability or have a security concern, please email hello@ratedesk.ai. We aim to respond within 48 hours and will not pursue legal action against good-faith security researchers who responsibly disclose issues to us.