Trust & Security
Last updated: July 19, 2026
Campaigns trust Politimate with sensitive voter data, and we treat that responsibility seriously. This page explains where your data lives, how it is protected, and how our controls map to the security requirements California places on voter-data systems.
Where your data lives
Politimate's platform is built on SOC 2 Type II-audited managed infrastructure: Supabase (managed PostgreSQL hosted on Amazon Web Services, US East (Ohio) region — all data resident in the United States) with a Vercel-hosted application layer (U.S.). We do not sell voter data, and each organization's data is isolated from every other tenant.
Security architecture mapped to 2 CCR § 19012
The table below maps each applicable § 19012 requirement to its implementation in the Politimate platform.
| § 19012 Requirement | Implementation |
|---|---|
| Strong, unique passwords per account — (b)(1) | Enforced password policy via Supabase Auth; unique credentials per user; no shared accounts. |
| Security best practices; least privilege; session lock ≤ 15 min; deactivate default accounts; erase data no longer needed — (b)(2) | Role-based access with PostgreSQL row-level security enforcing least privilege and per-client isolation; session timeout within 15 minutes of inactivity; default credentials disabled; data erased per NIST 800-88 when retention ends. |
| MFA on privileged accounts — (c)(1)(A) | Supabase Auth built-in multi-factor authentication enforced on all administrative and privileged accounts. |
| Account lockout ≤ 10 failed attempts; ≥ 30-min auto-unlock delay — (c)(1)(B) | Authentication rate limiting and lockout configured within these thresholds. |
| Password rotation ≤ 365 days — (c)(1)(C) | Credential rotation policy enforced on no less than an annual basis. |
| Encrypted backups stored separately (FIPS 197) — (c)(1)(D) | Automated Supabase backups encrypted with AES-256 and stored separately from production systems. |
| Security log management with real-time alerts; logs stored separately; synchronized U.S. time sources — (c)(2) | Database, authentication, and application logging enabled (who/what/where/outcome); log streams retained separately from monitored systems; alerting configured for anomalous activity; NTP-synchronized U.S.-based time sources (AWS). |
| System hardening: patching, current software, anti-malware, firewalls, vulnerability scanning — (c)(3)(A)-(D),(H) | Infrastructure patching, network firewalls, and host protections maintained by AWS/Supabase/Vercel under SOC 2 Type II attestations; application dependencies updated and scanned for known vulnerabilities on a regular cadence. |
| Encryption at rest (FIPS 197) and in transit (TLS 1.2+, valid certificates) — (c)(3)(E)-(G) | AES-256 encryption at rest; TLS 1.2+ for all connections with valid CA-issued certificates; no self-signed certificates. |
| Breach reporting within 24 hours — § 19013 | Any detected unauthorized use, suspected breach, or denial-of-service attack will be reported to the Secretary of State Elections Division Help Desk within 24 hours of discovery. |
Questions
For security questions, compliance documentation, or to report a concern, contact us at info@politimate.com.