How does Emergent (emergent.sh) protect user data?

Layer 1: Encryption (mostly handled for you)

Supabase encrypts data at rest by default and enforces TLS 1.2+ for all connections. You don't configure this — you verify it (HTTPS on your domain, no mixed content). Strong password hashing (bcrypt/argon2) is handled by Emergent (emergent.sh)'s auth provider if you use it, not if you roll your own. This layer rarely breaks.

Layer 2: Access control (where Emergent (emergent.sh) apps actually leak data)

Supabase Row Level Security is the authorization model for Emergent (emergent.sh) apps. A table without RLS is globally readable with the anon key. Every table needs policies of the form `(select auth.uid()) = user_id` enforced at the database layer — not the application layer. This is the layer that fails in real Emergent (emergent.sh) breaches.

Layer 3: Secret & credential handling

Emergent (emergent.sh) apps fail here predictably: service keys, third-party API keys, and admin credentials end up in frontend bundles. A service_role key in the browser bypasses all of Layer 2 by design. In Emergent (emergent.sh) specifically, "Client-Side API Key Leakage" is a known failure mode — third-party api keys are embedded directly in generated frontend code instead of server-side proxies.

Layer 4: Third-party data flow

Payment data (Stripe), analytics, email providers, webhooks — every integration is a data-protection question. Best pattern: keep sensitive data (PCI, PHI) off your servers entirely (Stripe Elements for card data, signed webhooks for integrations). Emergent (emergent.sh) apps that proxy payment data through their own backend have taken on PCI scope they don't need.

Layer 5: Compliance (GDPR, CCPA, HIPAA)

No platform makes your app compliant. You need: explicit consent UI, data export endpoint (JSON/CSV of a user's data), deletion endpoint that cascades correctly (including backups, audit logs, third-party copies), breach notification within 72 hours (GDPR Article 33), and records of processing activities. Emergent (emergent.sh) supports all of these at the infrastructure level; implementing them is app-level work.

The verification question

The single best test of "does Emergent (emergent.sh) protect my user data": use an incognito window, no login, and try to query your database endpoint directly (e.g., `curl https://your-project.supabase.co/rest/v1/users?select=*` with your anon key as the apikey header). If anything comes back that shouldn't, Layer 2 has failed. VAS runs this test programmatically across every endpoint.