Security Brief

Access control

• A practitioner sees a client only after the client accepts the practitioner's invitation. One consent check guards every practitioner action on client records, in the database rules and on the server.
• Clients who work with a practitioner sign in with an emailed single-use link. Free-app users need no account; a single-use link that expires in 15 minutes restores their records on a new device. Password sign-in is off.
• Practitioners and the administrator sign in with Google plus two-step sign-in (an authenticator app), and must have signed in within the last hour.
• Practitioners, the administrator and signed-in clients are signed out after 30 minutes idle.
• Access codes are issued by the server. An email address or a code alone opens no records. The sign-in step does say whether an email already has a chart, so it can send the link.
• The Triple Moon Goddess administrator account is the one account not limited by client consent. Its reads of birth data are audit-logged.

Encryption & data handling

• Encrypted in transit (HTTPS) and at rest.
• In our database, email addresses, birth data, practitioner notes and readings are encrypted with a managed Cloud KMS key that only server functions use. The key rotates every 90 days.
• Records are keyed by pseudonymous access codes. Email lookups use keyed fingerprints (HMAC-SHA256) with the key held in Secret Manager.
• Since October 8, 2026, application logs carry no email addresses, access codes or AI text; some older entries from September 20 to October 8, 2026 hold a newsletter sign-up's email address and are waiting to be removed by Google after their 30 days. Data-access audit logs record which records were read and by which signed-in account; an entry for a lookup by email address (correcting a client's email, deleting a client's data, or sending a sign-in link) also holds that address.
• Email addresses also go to the services that need them: Stripe for receipts, Google Calendar for booking invitations, MailerLite for the opt-in newsletter, and Google Workspace for mail.

AI

• Practitioner AI runs on the practitioner's own Anthropic API key, sent directly from their browser to Anthropic under the practitioner's own Anthropic account. That traffic is outside Triple Moon Goddess's systems and agreements.
• It receives the client's chart placements, scores, intake answers, journal entries and the practitioner's notes, labelled only “CLIENT”. Name, email, and birth date, time and place are never sent. Anything the practitioner types or attaches is sent.
• Lisa's own practitioner use runs through our server on the Triple Moon Goddess Anthropic account.

Backups & recovery

• Daily and weekly backups are kept 98 days, with point-in-time recovery for 7 days.
• A separate export vault in its own project is kept 30 days under a locked retention policy.
• Delete protection is on for the production database.

On release

• A release that changes database or storage rules ships only if every rule path, tried as each kind of user, answers exactly as expected. The same full test runs weekly.
• Every server function must have a written expected-access rule, and the attacker test suites must pass, before it can deploy.
• Before a production release, the code being shipped is scanned with Semgrep against our own security rules. The scan runs on our machine with network access blocked, so no code leaves it. Any finding stops the release.
• Right after a release through the standard deploy pipeline, a stranger attacks every live function, endpoint and storage bucket. An unexpected answer emails an alert at once, and the release is not recorded as complete until it is fixed.
• OWASP ZAP scans the apps and the website after release. Any finding fails the scan.

Continuous monitoring

• A stranger attacks production every day.
• Every request from the apps carries a Firebase App Check token from Google reCAPTCHA Enterprise, showing it came from our own pages. Requests without one are counted and, for now, still answered; refusing them waits until the counts show real visitors always pass.
• A weekly audit checks least-privilege access, key and secret rotation, credentials in code and critical or high dependency vulnerabilities, and runs a mutation test proving the tests catch an opened database rule. The report is sent every week, pass or fail.
• 10 breach and backup alerts, 5 of them with 24-hour checks for slow attacks, plus 3 application-error alerts.

Retention & deletion

• Clients can delete their data at any time. Their records, files and sign-in accounts are removed. Payment records keep only amounts and status. Practitioner notes stay until the practitioner deletes them. Deleting also deletes the client's MailerLite subscriber, their booking events on the business calendar (a future session is cancelled) and their Stripe customer; payment records Stripe must keep by law stay with Stripe. Each of those steps retries on its own, and one that keeps failing is emailed to Lisa and finished by hand. Backups age out within 98 days.
• When a cancelled practitioner subscription reaches the end of its paid period, that practitioner's records are deleted automatically. A suspended account keeps its records until it is restored or cancelled.
• Sign-in links work once and expire after 15 minutes. Return links expire 72 hours after the most recent email that carried them. Expired links are then deleted automatically.
• Records of which app a session opened are deleted automatically after 1 year, AI rate-limit counters after 30 days, and anonymous sign-in sessions after 1 year without use.
• Automated emails carrying client data are sent from a dedicated address and deleted from our mailbox after 30 days. Replies and calendar invitations are kept in our Google Workspace.

Audit logs

• Data-access audit logs are kept 6 years. The archived copy is held under a retention policy and is readable only by the account owner.
• Application logs are kept 30 days.

Available on request

• Data map: where client data lives and for how long
• Recent security test results and weekly audit reports
• OWASP ZAP scan reports
• A third-party penetration test, arranged on request