Security
Security built around your roadmaps.
Michi keeps a simple promise: turning a goal into a learning path should never make your data harder to protect. These controls describe the product as it runs today.
Last updated · October 23, 2026
Transport
TLS
Encrypted traffic in production
Storage
RLS
Account-scoped database access
Training
No
Goals and roadmaps are never used to train models
Controls
What protects your data
These controls cover the public site, the signed-in workspace, the database and the AI provider that maps goals into roadmaps.
Goals stay private
Goals, roadmaps and progress are scoped to your account. Michi never sells them and never uses them to train AI models.
Encryption
Stored data is encrypted at rest, and production traffic is served over TLS. Sessions run through secure browser cookies and protected API routes.
Scoped data access
Supabase Row Level Security returns only the rows that belong to the signed-in account, so one account cannot read or change another account’s roadmaps.
Key separation
Public browser keys, server-only service keys and the AI provider key are kept apart through environment configuration and never reach the browser.
Signed-in routes
Every roadmap, sprint, project and settings route checks who is signed in before it reads or writes data.
Read-only sharing
A share link opens a read-only view of one roadmap’s milestones, steps and resources. Nobody who opens it can change anything.
Development
Secure development practices
Security is part of how each change is built, not a checklist at the end.
- Validate public API input before business logic runs.
- Check authentication at every signed-in route.
- Give service keys and infrastructure the least access they need.
- Never log learning goals, generated roadmaps or provider secrets.
- Keep the demo workspace on seeded sample data, apart from real accounts.
- Run type, lint and test checks before a change ships.
Customers
How to help keep your account secure
Accounts
Protect credentials
Use a strong, unique password, avoid shared accounts, and change your password if you think it has been exposed.
Links
Share with care
Anyone with a roadmap's share link can read that roadmap. Keep personal details out of goals and step notes you plan to share.
Disclosure
Report issues quickly
Send security findings through the vulnerability disclosure policy.