Floodi Security Posture Overview
This page is written for procurement officers, IT security reviewers, and government evaluation teams. It covers implementation facts rather than marketing language. Last updated: June 5, 2026.
Web application, database, edge functions, NWS polling, and USGS ingestion running normally.
Infrastructure
Web hosting: Floodi is hosted on Cloudflare Pages with CDN distribution across 300+ edge locations. DDoS protection and WAF rules are active at all times.
Database: PostgreSQL hosted on Supabase. Data is encrypted at rest and in transit. Automated daily backups with point-in-time recovery available.
Storage: Flood report photos are stored in Supabase Storage (S3-backed) with Row Level Security policies. Photos pending moderation are stored in a private bucket inaccessible to the public.
Edge functions: Serverless compute on Supabase Edge Functions (Deno runtime). Functions handling sensitive operations require JWT verification.
Data region: Supabase project hosted in AWS us-east-1 (N. Virginia). U.S.-only region pinning can be confirmed contractually for government engagements.
Security controls summary
| Control area | Implementation |
|---|---|
| Data in transit | TLS 1.2+ enforced at Cloudflare edge for all connections to floodi.app and all Supabase API calls. |
| Data at rest | Database and storage data encrypted at rest by Supabase's underlying infrastructure (AWS/GCP with AES-256). |
| Access control | Supabase Row Level Security (RLS) enforced on all tables. Public feed exposes only public-safe fields. Admin operations require authenticated role. |
| Authentication | Supabase Auth with email-based authentication. Admin actions require a verified session token. |
| Edge function security | Supabase Edge Functions require JWT verification for all protected operations. No unauthenticated writes to the database are permitted. |
| Photo metadata | EXIF and GPS metadata are stripped from all uploaded photos on ingest before any public storage or display. |
| DDoS protection | Cloudflare WAF and DDoS mitigation active at the edge layer across all web delivery. |
| Rate limiting | Community report submissions capped at 5 per hour per account, enforced at the database level. Photo upload limits enforced per session. |
| Audit logging | Admin and moderation actions are logged in the audit_logs table. Organization-level activity is logged and exportable to pilot partners. |
| Photo moderation | All submitted photos are classified by AI (Gemini Vision) before public display. Photos that fail content safety checks are rejected or queued for manual review — never auto-published. |
What data Floodi stores — and what it does not
Floodi stores
- Report coordinates (lat/lng), severity, timestamp
- Optional: street name, city, county (user-provided text)
- Optional: photo (EXIF-stripped before storage)
- Optional: text comment (max 280 chars)
- Email address for alert subscriptions (encrypted)
- Admin and moderation action logs
Floodi does NOT store or sell
- Photo GPS EXIF data (stripped on ingest)
- Raw payment card numbers or full card data
- Government-issued ID or financial account data
- Protected health information (PHI)
- Classified or CUI data of any kind
- User location history beyond submitted report coordinates
- Third-party ad tracking data
Third-party providers and compliance
| Vendor | Purpose | Compliance |
|---|---|---|
| Supabase | PostgreSQL database, Auth, Storage, Edge Functions | SOC 2 Type II |
| Cloudflare | CDN, DDoS protection, DNS, Pages hosting | SOC 2 Type II, ISO 27001 |
Regulatory posture
FedRAMP: Floodi is not currently FedRAMP-authorized. The underlying Supabase and Cloudflare infrastructure operates on SOC 2 Type II certified platforms. Floodi will pursue the appropriate authorization path if required by a specific award or contract.
NIST alignment: Floodi maps its controls to NIST SP 800-53 / NIST CSF control families relevant to a low-impact public data service. Full control mapping is available on the data governance page.
GDPR / CCPA: See the Privacy Policy for personal data handling rights and deletion requests.
Data sales: Floodi does not sell user data. Full details in the Privacy Policy.
Vulnerability disclosure
Security researchers are encouraged to report suspected vulnerabilities to [email protected].
Please include: a description of the vulnerability, reproduction steps, the impacted endpoint or component, and proof of concept if available. Do not exfiltrate data or attempt destructive testing.
Floodi will acknowledge reports within 2 business days, triage within 5 business days, and provide a remediation timeline for confirmed vulnerabilities. We do not currently offer a formal bug bounty program.
Security contact
Security inquiries: [email protected]
Government procurement security review: [email protected] — subject "Security review — [Agency name]"
See also: Government & federal data governance · Privacy policy · Federal readiness