How we protect your most sensitive data — and where we're headed.
Every sensitive field — partner names, encounter notes, health records, and personal identifiers — is encrypted at the application layer using AES-256-GCM before it reaches the database. This is the same encryption standard used by banks and governments.
Each user has a unique encryption key derived from a master secret using HKDF (HMAC-based Key Derivation Function). This means that even if the database were compromised, encrypted fields cannot be decrypted without the application-layer keys.
Emails are additionally hashed with SHA-256 + a secret pepper for lookups, so the plaintext email is never used as a database key.
All communication between your device and Navilla is encrypted in transit using HTTPS/TLS. We enforce secure transport across all environments.
Authentication uses token-based session management via Supabase Auth. Passwords are never stored in plain text. Sessions expire and require re-authentication. Refresh tokens are rotated on every use.
The backend API validates every request against your session token before returning any data. You can only access data that belongs to you. No data is publicly accessible without authentication.
Our current architecture encrypts data at the application layer — the server encrypts and decrypts on your behalf. This protects against database breaches and unauthorized access, but it means the server can technically read your data during processing.
We are working toward true end-to-end encryption (E2EE), where your data is encrypted on your device before it ever leaves, and only your device holds the keys. This is the model used by Signal and Telegram's secret chats — the server becomes a blind relay that stores data it cannot read.
The goal: even if Navilla's servers were fully compromised, your health data, partner names, and encounter history would remain unreadable.
Transactional email is configured with modern domain authentication controls (SPF, DKIM, DMARC) to reduce spoofing risk.
If you discover a security vulnerability in Navilla, please report it responsibly to contact@navilla.app. We take all reports seriously and will respond promptly.