1. Introduction
Full Scale AR is committed to protecting user data and maintaining a secure platform for all assets needed for Full Scale AR visualizations. This document outlines our current security architecture, administrative access policies, and our roadmap toward industry-standard certifications.
2. Current Security Measures
2.1. Authentication
- Supabase Auth with bcrypt password hashing. passwords are never stored in plaintext
- Google OAuth 2.0 support for federated sign-in
- Session tokens managed server-side with secure, HTTP-only attributes
2.2. Authorization
- Row-Level Security (RLS) enforced on all database tables. users can only access their own data
- Role-based access control via a dedicated
user_roles table and a has_role() security definer function to prevent privilege escalation - Administrative roles are never stored on the user profile table
2.3. Data Storage
- All files hosted on Supabase Storage (backed by AWS S3)
- Model access via signed URLs with a 1-hour expiry. no permanent public links
- Service-role-only inserts for sensitive tables (e.g., access logs) to prevent client-side tampering
2.4. Rate Limiting
- IP-based rate limiting on public-facing endpoints
- Configurable request windows and thresholds per endpoint
- Automatic cleanup of expired rate-limit records
2.5. Password-Protected Spaces
- Space passwords hashed with bcrypt via the pgcrypto extension
- Verification performed server-side through a database function. plaintext passwords are never stored or transmitted after hashing
2.6. Transport Security
- All data transmitted over HTTPS with TLS encryption
- No unencrypted HTTP endpoints
3. Administrative Access
As disclosed in our Privacy Policy (Section 2.3), Full Scale AR administrators have the technical capability to view uploaded 3D models and Scene data. This access is used strictly for:
- Technical support and troubleshooting
- Debugging and quality assurance
- System maintenance and security
Models and Scene content will not be downloaded, reproduced, modified, or used for any purpose without explicit consent from the Space owner. Administrative access is restricted to authorized personnel only.
4. Security Roadmap
Next
Phase 1. SOC 2 Type I Compliance
Point-in-time assessment of security control design
- Document formal security policies, access controls, and incident response procedures
- Implement comprehensive audit logging across all administrative actions
- Engage a third-party auditor to assess the design of security controls at a specific point in time
- Obtain SOC 2 Type I report confirming controls are suitably designed
Future
Phase 2. SOC 2 Type II Compliance
Demonstrating sustained operational effectiveness over time
- Undergo a review period of 6–12 months to demonstrate that security controls operate effectively on an ongoing basis
- Establish continuous monitoring, automated alerting, and periodic internal reviews
- Engage a third-party auditor for the Type II report confirming operational effectiveness
- Commit to periodic re-assessment and annual recertification
5. Contact
For security inquiries, vulnerability reports, or questions about this whitepaper, please contact: support@fullscalear.com