Built for professionals who handle sensitive data

Authentication

Cloudymonkey uses magic link (OTP) authentication only — there are no passwords to store, hash, breach, or forget. Every login is a one-time, expiring token sent to your verified email address.

• No password database — eliminates the most common breach vector
• Magic links expire after 10 minutes
• Each link is single-use
• Sessions are JWT-signed and automatically expire
• Powered by Supabase Auth (SOC 2 Type II certified)

Encryption

• In transit: TLS 1.2+ enforced on all connections — no HTTP fallback
• At rest: AES-256 encryption on all stored data (AWS/Supabase)
• HSTS: HTTP Strict Transport Security enforced with 1-year max-age and preload
• API keys: Never stored in client-side code — all third-party API credentials live exclusively in server-side environment variables

Application Security

• Content Security Policy (CSP): Restricts script and resource origins to an explicit allowlist
• X-Frame-Options: DENY: Prevents clickjacking attacks
• X-Content-Type-Options: nosniff: Prevents MIME-type sniffing
• Referrer-Policy: Strict origin control on all outbound links
• Permissions-Policy: Camera, microphone, geolocation, and payment APIs disabled by default
• Row-level security: Database queries are scoped to the authenticated user at the database level — not just application logic

Infrastructure

Cloudymonkey is built on infrastructure providers that hold independent security certifications:

All data is stored and processed in the UK or EU (Ireland). We do not transfer personal data outside of the UK/EEA.

Access Control

• The agent dashboard requires a valid authenticated session — unauthenticated users are immediately redirected to login
• The admin panel is restricted to a single authorised email address
• All API endpoints require a valid JWT bearer token — no anonymous access to agent data
• Third-party API calls (flight search, bookings) are server-side only — your clients' data never passes through browser-side code to external APIs

Email Security

• SPF: Authorised sender policy in DNS
• DKIM: Cryptographic email signing on all outbound mail
• DMARC: Policy enforcement to prevent spoofing
• All login emails sent from @cloudymonkey.com via Resend (EU region)

Data & Backup

• Automated daily database backups via Supabase
• Point-in-time recovery available
• Saved quotes are stored in your local browser storage — they never leave your device and are not held on our servers
• Passenger booking data is passed directly to the airline fulfilment provider and is not stored on Cloudymonkey's servers

Monitoring & Incident Response

• Platform and edge function logs retained for security review
• Suspicious access patterns trigger session invalidation
• In the event of a confirmed data breach affecting your account, we will notify you within 72 hours in accordance with UK GDPR Article 33
• To report a suspected security incident: security@cloudymonkey.com