Security at MariaGuides
What we do to keep your guides and your account safe, in plain words.
Where your data lives
Your guides, screenshots and account data are stored with Supabase in AWS's Tokyo region (ap-northeast-1).
Supabase encrypts all data at rest with AES-256 and in transit with TLS, and holds SOC 2 Type 2 and ISO 27001 certifications.
Our database is backed up daily, and we can restore any of the last 7 days.
Access rules
Every table in our application's database has row-level security switched on, so the database itself enforces who can see what, not only the app.
Signing in
There are no MariaGuides passwords to set, remember or reset. You sign in with an emailed link (a code in the extension), Google or GitHub.
Two-factor authentication, with an authenticator app and one-time recovery codes, is available on every plan, including Free.
Once two-factor is on, a session that hasn't entered the second code can't read or change anything.
Your screenshots
Screenshots and videos are kept in private storage. In the app, images load through links that expire after one hour.
Applying a blur replaces the stored screenshot, and the original is deleted. Downloads, exports or videos made before the blur keep the original.
Sharing
Someone without an account can see a guide only through a public link you created, on a paid plan, and you can turn the link off at any time.
People reading a public link are counted, not identified. We store no IP address, account or cookie for them, only a random ID their browser keeps and what they viewed.
The extension
The extension never asks for site access at install. It asks only when you choose to allow it, and it contains no remotely loaded code.
Keeping and deleting
Guides are kept until you delete them; we never purge them automatically. "Delete forever" removes a guide's screenshots, videos and other files, then the guide.
How we build
Server keys never ship in the app or the extension, and an automated check scans every change we push for them.
We run internal, automated security reviews of our code and database rules, and work through what they find.
Our providers
Vercel hosts the site and app (SOC 2 Type 2, ISO 27001:2022, HTTPS on every page).
Cloudflare runs our DNS and shared-guide pages (SOC 2 Type II, ISO 27001:2022).
Resend sends our email (SOC 2 Type II).
Sentry receives error reports, stored in its EU region in Frankfurt (SOC 2 Type II, ISO 27001).
Every MariaGuides address is served over HTTPS, and plain-HTTP requests are redirected to it.
Report a problem
Found a security issue? Email support@mariaguides.com.