The foundation
Several layers, different jobs.
Supabase Auth handles artist account authentication. AntiMess uses authorization controls for workspace access, database row-level security rules, and storage buckets with different visibility according to the type of file.
These are application and configuration controls, not a claim that every piece of content is private or that access can never be misused. The sections below explain the important distinctions.
Who can see what
Access is tied to the work.
Artist accounts use Supabase Auth. Workspace access links use a capability: the application validates the link’s access token before returning the associated workspace information. A link can let its holder access the information made available through it, even without an AntiMess account.
AntiMess uses database row-level security to help keep workspace data scoped to the right people. Those rules are one part of enforcing access boundaries; a shareable link is still sensitive and should be sent only to its intended recipient.
Storage
Private when needed. Public when intended.
Storage includes private areas for sensitive uploads, with access checks for viewing them, and deliberately public assets. A public asset is not protected like a private attachment simply because it belongs to an artist’s workspace.
Profile images are public-facing. Uploads require an artist account and are restricted to that artist’s own profile-image area; production checks rejected another artist’s upload and an anonymous upload.
Keep client links and sensitive attachments within the intended conversation. Once an authorized recipient can view or download something, AntiMess cannot prevent them from making their own copy.
Privileged access
Extra checks for admin routes.
Administrative access is configured with role checks and authenticator-based multi-factor requirements, enforced on protected server routes. Production checks rejected requests without admin authorization; a complete authorized admin sign-in and MFA journey has not been independently tested. These requirements apply to administrators, not every artist account.
Selected admin actions have restricted audit records. This does not mean every event in the application is audited or continuously monitored.
Web and API
Browser protections have a specific role.
Production web pages and API responses include a Content Security Policy and headers that limit content-type guessing, framing, referrer information, and access to certain browser features. These are additional browser safeguards, not a substitute for authentication or access checks.
The production API allows browser access from approved AntiMess origins, not arbitrary websites. This CORS rule controls which sites can read API responses in a browser; it does not by itself prevent requests or authorize a user.
Money flow
Payments go to the artist, not through AntiMess.
Current card checkout is disabled. Clients pay artists directly using payment methods configured by the artist. AntiMess may display instructions and keep payment-related records, but does not collect or hold client payments.
If a payment method leads to a third-party service, that service has its own practices. Check the artist’s instructions before sending money.
The wider picture
Security is only part of the story.
Our Privacy Policy describes the information handled by AntiMess, sharing, retention, and available requests. The Terms of Service explain the terms of using the service.
Supabase provides authentication, database, and file-storage infrastructure; AntiMess configures the application access controls described here. These application checks are not independent verification of provider infrastructure, backups, recovery, or encryption specifications. We do not promise immediate deletion from backups.