Security

Security at Motabhai

Last updated: 21 October 2026

What we do to protect your data, stated plainly. No slogans.

Where your data lives

Your account, business and invoice data is stored in a PostgreSQL database hosted by Supabase in its ap-northeast-1 (Tokyo) region. Documents you upload — receipts, invoices, bank statements — are kept in private Supabase Storage buckets that are not publicly accessible.

Encryption

Every connection to Motabhai uses TLS, so your data is encrypted while it travels. Data stored in the database and in file storage is encrypted at rest by Supabase, our hosting provider.

Access separation

Every table in our database has Row Level Security enabled. A signed-in user can only read rows belonging to a business they own or were invited to. A business has three roles — owner, accountant and staff — and only the owner can invite or remove people.

Sign-in

You sign in with an email one-time code or with Google. Motabhai does not store passwords. Two-step verification (authenticator app) is available in Settings → Security. Keep your email account protected.

Payments

Card payments are handled entirely by Stripe. Motabhai never sees or stores your card number.

Subprocessors

We use a small set of providers to run the service:

• Supabase: ap-northeast-1 (Tokyo): database, authentication and private file storage.
• Stripe: Payments. Motabhai never sees or stores your card number.
• Resend: Email, including sign-in codes and account emails.
• Sentry EU: Errors — financial fields are redacted.
• PostHog EU: Product analytics — amounts are bucketed, no names.
• Google Gemini via Lovable AI Gateway: Ask Motabhai receives your question, knowledge-base passages and your account figures summary. Document analysis receives the uploaded file's text or image.

Document retention

Documents are kept until you delete them. We recommend keeping records for 7 years.

Backups

Database backups are managed by Supabase. Restore procedure documented; last rehearsal: pending.

Reporting a problem

If you find a security issue, email code@motabhai.tax. We take these reports seriously and will respond promptly.

Motabhai is not a registered tax agent and is not affiliated with, approved by or accredited by the Federal Tax Authority.