Compliance
How we build and operate client platforms
Mosaic Ridge LLC hosts production workloads on US-based infrastructure with TLS-enforced transport, an OWASP-aware build process, and access controls scoped to what each engagement actually deploys. Detailed security documentation is available to qualified prospects under NDA.
What this page covers
This describes how we build and operate platforms for clients. Controls below apply where an engagement includes the system in question: a marketing site with a contact form has a very different surface from a multi-tenant portal, and we do not claim the portal’s controls on the brochure site.
This website is itself the simple case: statically rendered pages and a single rate-limited contact form that sends through Resend. It stores no customer data, has no user accounts, and processes no payments.
Hosting & sub-processors
On every engagement
- Application hosting
- Vercel: US-based regional edge network with serverless compute. SOC 2 Type 2 attested.
- Email transport
- Resend: transactional email with TLS-enforced delivery and DKIM/SPF on all outbound mail.
Where the scope calls for it
- Database
- Supabase managed Postgres: SOC 2 Type 2 attested. Encrypted at rest with backups retained per service tier. Used on engagements that store data.
- Payment processing
- Stripe: PCI DSS Level 1. We never store payment card data. Used on e-commerce and billing engagements.
- Object storage
- Supabase Storage with row-level security enforced for tenant isolation. Used where an engagement stores client-uploaded files.
The sub-processors for your engagement are the ones your scope requires, and no others. A complete list is provided to qualified prospects under NDA as part of vendor diligence.
Transport & authentication
- TLS 1.2+ enforced on every public endpoint
- Strict-Transport-Security headers on every production deployment
- HTTP/2 on all production deployments
- Content Security Policy headers, with the allowlist scoped per project
Access control, where an engagement has accounts
- Role-based access control on any administrative interface we build
- Database-level row security on every multi-tenant table we deploy
- Sessions secured with httpOnly + Secure + SameSite cookies
- PKCE-protected OAuth wherever an engagement includes a third-party sign-in flow
- Least-privilege service credentials, never a shared or long-lived admin key
Data handling
- Client data is encrypted at rest by the underlying database providers
- We do not store payment card data; where an engagement takes payments, Stripe holds all PCI scope
- Data residency: production workloads run in US-based regions
- Backup retention follows the service tier of the underlying database; documented per-engagement
- Sub-processor list provided to qualified prospects on request
Build process & standards
- Custom-coded Next.js, not a rented template
- OWASP Top 10 awareness baked into the build process
- Automated dependency scanning and patching via Dependabot
- All deployments require lint, type-check, test, and build to pass before merge
- Security advisory disclosures via npm audit reviewed on every dependency change
Incident response
- We document and disclose security incidents to affected clients within 72 hours of confirmation
- Detailed incident response plan available under NDA for procurement diligence
- Post-incident reports include root cause, remediation, and prevention measures
Standards summary
- Accessibility: WCAG 2.1 Level AA (see Accessibility Statement)
- Section 508: Section 508 conformant on public-sector engagements
- Application security: OWASP-aware build process. Custom-coded, not a rented template.
Request security documentation
For vendor due-diligence reviews, we provide a more detailed security packet under NDA on request, including sub-processor list, incident response plan, data flow diagrams, and architecture summary.
Request security documentation