Trust · Security · Privacy
How we protect your workspace
Feedbackrabbit is a workspace tool for confidential B2B research. This page is editable project content — it describes the controls in place today and is not an independent certification.
Authentication
Sign-in is handled by Supabase Auth (email/password and Google). Sessions use short-lived bearer tokens that are validated server-side on every protected call. The service-role key is never sent to the browser.
Data isolation
Each customer, project, persona, reactor session and presentation belongs to an organization. Row-Level Security policies in the database limit reads and writes to members of that organization. Server functions execute with the caller's identity so that even an admin connection cannot read another workspace's rows on a regular query path.
File uploads
Uploaded files (research attachments, reactor inputs, slide media) are stored in private buckets. Access is path-scoped to the uploading user and served via short-lived signed URLs. Upload size and MIME types are validated server-side before the file ever touches storage.
Secrets & AI
Provider API keys live in server-side secret storage and are read only by server functions. AI calls (Gemini and others) are proxied through the backend so keys never leave the server. Prompt content and outputs are scoped to your workspace and used only to fulfil the request.
Error handling
Server errors are logged server-side. Responses returned to the browser contain only generic messages so internal schema or provider details are not exposed.
Reporting an issue
Please contact info@flowrabbit.ai with a description and steps to reproduce.