People · Events · Communities
Last updated: October 30, 2026
Report a security issue: security@meloraconnect.com. Support: support@meloraconnect.com or (240) 896-1404.
1. Where Melora Connect runs
1.1 The application runs on Cloudflare's network. Data, sign-in and files are stored with Supabase, a managed database and storage provider, in Canada (Amazon Web Services, Montreal). Payments are processed by Stripe. The full list of providers is in our Privacy Policy.
1.2 Connections to Melora Connect use HTTPS. Plain HTTP requests are redirected to HTTPS, and browsers are told to use only HTTPS for our domain. The application sends a Content Security Policy so injected scripts cannot run.
2. Keeping each organization's data separate
2.1 Access rules are enforced in the database itself, not only in the app. Row-level security rules decide which rows each signed-in user can read or change, based on their organization and role. This is designed so that one Organization cannot see another Organization's data, and a member sees only what their Organization allows.
2.2 Organization administrators control staff roles and permissions. Sensitive actions, such as approving payments or countersigning contracts, need specific permissions.
2.3 Uploaded files, such as member documents, vendor documents and application uploads, are kept in private storage. Profile photos are public by design.
2.4 Melora staff access. Melora staff have no standing access to an Organization's member, payment or other records. A staff member who needs it, mainly to help with a support request, asks for access to that one Organization, with a written reason and a time limit of one hour to one week. One of a small number of designated approvers at Melora must approve it, nobody can approve their own request, and the access ends by itself when the time runs out or when it is revoked. These rules are enforced in the database. Every request, decision and revocation is recorded, along with each time a staff member opens that Organization's records or signs in to it as an administrator. Help requests sent to Melora are handled by our support team without this approval.
3. Signing in
3.1 Accounts sign in with an email address and password through Supabase Auth. Passwords must be at least 8 characters and are never stored by Melora in readable form.
3.2 Sign-in, password reset, invitation, membership application, public donation and demo request pages use Cloudflare Turnstile to block bots.
3.3 Two-step sign-in. Two-step sign-in is optional for everyone. Once it is on from your own account page, signing in asks for a 6-digit code from an authenticator app as well as your password, and the database refuses a session that has not passed that step. If you lose access to your authenticator app, contact our support team.
3.4 Signed-in sessions end 7 days after sign-in.
4. Payments
4.1 MeloraPay runs on Stripe Connect. Card details are entered in Stripe's own payment forms and go straight to Stripe; they do not pass through or get stored on Melora's servers.
4.2 Stripe collects identity documents and bank details directly during onboarding. For payments and payouts, Melora never collects, stores, logs or transmits tax identification numbers, bank account or routing numbers, or dates of birth. An Organization can choose to ask applicants for personal details, such as a date of birth, in its own application forms, and those answers are stored with its other records.
4.3 Every charge is made on the Organization's own Stripe account, and the code refuses to charge without one, so member money never lands in Melora's balance by mistake.
4.4 Messages from Stripe and our email provider are accepted only when their signatures verify. Scheduled internal jobs require a secret key.
5. Encryption
5.1 Data is encrypted in transit with HTTPS and encrypted at rest by our database and storage provider. Webhook signing secrets are kept in an encrypted vault, and API keys are stored only as a one-way fingerprint. Other fields are not separately encrypted by Melora, and messages are not end-to-end encrypted; Section 8 explains who can read them.
6. Protection against abuse
6.1 Public forms and sensitive endpoints are rate limited. For example, a single email address can submit only 3 vendor applications a day, and address search is limited per user.
6.2 API. The Melora Connect API, available on Enterprise plans, uses keys that belong to one Organization and are stored only as a one-way fingerprint. Each key can make 120 requests a minute, each Organization 600 a minute across all its keys, and each address 50 requests every 10 seconds. An address that presents 30 wrong keys within 10 minutes is refused until that period ends, and requests larger than 64 KB are refused.
7. Audit logs
7.1 Important actions, such as vendor application submissions, contract countersignatures, account deletions and permission changes, are recorded in an audit log. Organization administrators can review their organization's audit log in the admin portal.
8. Messages
8.1 Messages are stored on our systems. Inside Melora Connect, a conversation can be read only by the people in it and, for conversations with vendors, the Organization staff who manage vendors. Melora staff do not read messages in the normal course of business. They can reach them only through an approved support access (Section 2.4) or, for a small number of engineers, through database administration access, when needed to investigate a reported problem, keep the platform safe or meet a legal requirement.
9. Monitoring without personal data
9.1 We use error monitoring to find and fix problems. Error reports carry an internal user ID, and are configured not to include names, email addresses, IP addresses, cookies or sign-in headers.
10. No advertising trackers
10.1 Melora Connect has no advertising trackers. Organization event pages count visits with a random visitor ID; see the Privacy Policy for this and the other browser storage we use. Analytics on our website and the application, where used, are described in the Privacy Policy, and are never used for advertising.
11. Backups and deleting data
11.1 The database is backed up once a day. Each backup is encrypted before it is stored, is kept with Cloudflare, separately from our database provider, and is deleted after 30 days. Only Melora's designated key holders can decrypt a backup. We have tested a full restore of the database.
11.2 When a member deletes their account from the member portal, their sign-in account and profile are deleted and the deletion is recorded in the audit log. The Organization keeps its own member record under its retention settings, and marking a record anonymized does not delete it. Copies in backups are deleted within 30 days, as backups rotate.
12. Security incidents
12.1 If we confirm a security incident that affects your personal information or your organization's data, we will tell affected account owners without undue delay, and no later than 72 hours after confirming it, with what happened, what we are doing and what you should do. Organizations are responsible for notifying their own members where the law requires, and we will give them the information they need.
13. Reporting a vulnerability
13.1 If you find a security issue, email security@meloraconnect.com with the steps to reproduce it. We aim to acknowledge your report within 2 business days and to fix or mitigate confirmed issues within 30 days, depending on severity.
13.2 Please give us reasonable time to fix the issue before disclosing it. Do not access, change or delete data that is not yours, do not disrupt the Service, and do not use social engineering. We will not take legal action against good-faith research that follows these rules, and we will credit you if you want us to.
14. What we are working on
14.1 These controls are planned and not available yet:
- Session timeout settings an Organization can choose.
- IP address allowlists for administrator access.
- Single sign-on for Enterprise plans.
14.2 Melora does not currently hold security certifications such as SOC 2 or ISO 27001.
