Data processing & providers
How infrastructure supports your account and private recordings.
Controller and processors
The operator determines the purposes of account and community processing. Infrastructure suppliers perform specified tasks on its behalf where they act as processors. This page is an information summary, not a data-processing contract for users to accept.
Supabase — selected
Used for authentication, the application database, private recording storage, invitation quotas and friendship records. The selected Toravii project region is Paris (eu-west-3).
The operator must verify its applicable Supabase contract, DPA, subprocessors, backup/log retention and international access arrangements. A published provider DPA does not by itself establish that all deployment requirements are fulfilled.
Netlify — planned
Intended to serve the website and its server endpoints. This build has not yet been deployed to a confirmed Netlify site. Request metadata and submitted data passing through endpoints may be processed by the host.
Confirm the Netlify account, applicable DPA, service region, log configuration, subprocessors and transfer safeguards before publication.
Email delivery — not finalised
Supabase sign-in uses email codes. The production email provider and its retention and transfer terms are not confirmed. No newsletter provider or marketing list is integrated.
Protection in the current build
Private recording bucket; server-side audio-length validation; authenticated access to user records; database row-level security; service credentials reserved for the server; email-bound, single-use invitation links.
The actual deployment still needs verified access controls, secret configuration, deletion procedures, backup recovery and incident-response arrangements. No security certification or absolute security guarantee is claimed.