GroundTruth Systems
Security
Farm Fresh Marketing · Updated July 30, 2026
Overview
GroundTruth Systems operates Farm Fresh Marketing (https://farmfreedom-marketing.onrender.com). This page summarizes how we protect accounts and workspace data for farmers and institutional buyers reviewing our practices. It is not a SOC 2 or ISO 27001 attestation.
What we protect
- Account credentials handled by Supabase Auth
- Farmer profiles, inventory, calendar, and caption workspace data
- Billing metadata via Stripe (card numbers stay with Stripe)
- Optional Square connection tokens, encrypted at rest
- Product analytics via PostHog with path and property sanitization
Controls in place
- Transport — HTTPS/TLS for browser and API traffic
- Access — session auth, Row-Level Security on tenant-scoped tables, separate app and intelligence databases
- Secrets — environment variables on the host; never shipped to the browser or committed to source control
- Feature gates — incomplete high-risk surfaces (B2B, stipend, and similar) stay fail-closed in production until verification gates pass
- Backups — provider daily backups on the current Supabase Free plan (7-day retention; no point-in-time recovery)
Honest gaps
- No SOC 2 / ISO 27001 certification today
- A full production database restore drill remains deferred until a Supabase Pro+ upgrade or equivalent paid restore path
- Automated CI security gates are not yet restored; releases rely on local tests and manual review
- Leaked-password screening is unavailable on the Free Supabase Auth plan and is an accepted interim risk
Report a vulnerability
Do not open a public issue with exploit details or credentials. Email dev.gts@protonmail.com with the affected component, sanitized reproduction steps, and likely impact. We aim to acknowledge Critical reports the same business day.