How we protect your data
This page is maintained by ASEAN Rising to answer common security and privacy questions about the platform.
Document uploads and the File Vault
Documents you upload are stored in a private storage bucket. The bucket is not public, so files cannot be browsed or downloaded by anyone without an active signed-in session.
Access is enforced at the database layer by row-level security rules. Each file is stored in a folder scoped to your user account, and the authenticated owner or a designated admin can view it. Other signed-in users cannot access your uploads.
When you share a file by WhatsApp or email, the platform creates a temporary signed link. That link expires automatically after seven days and can be regenerated from the File Vault at any time.
Retention and deletion
When a file is deleted from the File Vault, the metadata row is marked as deleted and the underlying file is held for 30 days. After that grace period, a nightly cleanup job permanently removes both the storage object and the metadata row. This gives you a 30-day window to recover a file deleted by mistake.
Files that are not tracked in the File Vault, such as images embedded directly in articles, are removed from storage immediately when deleted.
Authentication and access control
Editor and admin areas are protected by authentication. Admin-only actions, including viewing the full File Vault or deleting files, are checked server-side for the admin role in addition to the route-level sign-in gate.
We do not rely on client-side flags or local storage to decide whether someone is an admin. Every sensitive request is re-validated on the server.
Hosting and backups
The platform runs on managed cloud backend infrastructure hosted in Southeast Asia. Backups are encrypted at rest. We do not run third-party advertising trackers on the site.
What we do not claim
This page describes the controls that are visible in the application and its backend configuration. It is not an independent security certification, audit report or legal warranty. We do not claim SOC 2, ISO, GDPR, HIPAA, PCI or equivalent compliance unless we have separately completed and published that process.
Reporting a concern
If you have a security question or believe you have found a vulnerability, email privacy@aseanrising.com. We review reports promptly and will respond to verified requests within 30 days.