Trust & security
Security & Data
MissionKonsol is built on established, independently-audited infrastructure providers rather than custom-rolled security — the same approach most well-run early-stage SaaS products take. Here's specifically what that means.
Where your data lives
Your data is stored in Supabase, a hosted Postgres platform used by thousands of production applications. Data is encrypted in transit (TLS) and at rest, standard for any modern managed Postgres provider.
Who can see your data
Authorization is enforced by Postgres Row Level Security (RLS) — not application code you have to trust blindly. Every table that holds your workspace's data has a database-level policy checking real organization membership before returning a single row, so even a bug in MissionKonsol's own code can't leak another workspace's data. The one deliberate exception: conversations with the Secretary assistant are private to whoever asked, visible to no one else on your team, not even the workspace owner.
Passwords & authentication
Sign-in is handled by Supabase Auth, which hashes passwords with industry-standard algorithms — MissionKonsol never sees or stores your plaintext password.
Payments
Billing is processed by Stripe. MissionKonsol never receives or stores your card number — Stripe handles that entirely, the same provider used by a large share of the software you already pay for.
Transactional email (invites, reminders, document delivery) is sent through Resend, a dedicated email API provider — not a self-hosted mail server. Campaign email is different: MissionKonsol never sends your campaigns through its own mail infrastructure. Instead, you connect your own SMTP account (Zoho, cPanel, Namecheap, AWS SES via SMTP, and most other providers work), or opt into a capped fallback we operate through AWS SES. If you connect SMTP, your password is encrypted (AES-256-GCM) before it's stored and is only decrypted on our server immediately before sending — it's never shown back to you or anyone else after you save it.
AI features
The Advisor/Secretary, Diagnostic recommendations, and Playbook document generation are powered by Google's Gemini API. Prompts sent to Gemini include the real business data needed to ground a useful answer (your diagnostic scores, recent metrics, etc.) — see our Privacy Policy for the full list of what's shared and with whom.
Account deletion
Self-serve account deletion is built in — no waiting on an email reply. A member's account deletes cleanly while shared team content stays intact; a sole workspace owner's deletion removes the whole workspace.
Questions
If you have a specific security question not answered here, reach out — see the Terms of Service for contact details.