Encryption everywhere
All data is encrypted in transit using TLS 1.2+ and at rest using AES-256. Your health data never travels unprotected.
Security
Your health data, protected.
Whole handles sensitive health information: your movement, nutrition, sleep, mood, and soul check-ins. We take that responsibility seriously. Here's how we keep your data safe.
How we protect you
Security by design.
Data residency
Your data is hosted on Supabase infrastructure with region-based data residency. Database, auth, and storage are isolated per project.
Authentication & access
We use Supabase Auth with row-level security (RLS) policies. Your data is only accessible to you. No other user or employee can view it without explicit authorisation.
Minimal data collection
We only collect the data necessary to deliver your wellness insights. We never sell your personal information to third parties.
Compliance
Whole is built to comply with the Protection of Personal Information Act (POPIA) and the UK General Data Protection Regulation (UK GDPR). Our infrastructure provider, Supabase, is SOC 2 Type II certified.
Responsible disclosure
If you discover a security vulnerability, please report it to security@joinwhole.app. We take every report seriously and will respond promptly.
Sub-processors
Who handles your data.
We use a small number of trusted infrastructure providers. Each meets strict security and compliance standards.
| Provider | Purpose | Location | Certification |
|---|---|---|---|
| Supabase | Database, authentication, file storage | Region-based (configurable) | SOC 2 Type II |
| Vercel | Application hosting and edge delivery | Global edge network | SOC 2 Type II |
| OpenAI | AI-powered wellness insights | United States | SOC 2 Type II |
| Sentry | Error monitoring and performance | United States | SOC 2 Type II |
Supabase
Database, authentication, file storage
Region-based (configurable)·SOC 2 Type II
Vercel
Application hosting and edge delivery
Global edge network·SOC 2 Type II
OpenAI
AI-powered wellness insights
United States·SOC 2 Type II
Sentry
Error monitoring and performance
United States·SOC 2 Type II
Certifications
Our compliance roadmap.
Active
SOC 2 Type II
Via our infrastructure provider, Supabase. Covers data security, availability, and confidentiality.
Active
POPIA & UK GDPR
Compliant with the South African Protection of Personal Information Act and the UK General Data Protection Regulation.
On roadmap
ISO 27001
Information security management system certification. Planned as we scale our enterprise offering.
Questions about security?
We're happy to answer any questions about how we protect your data.