Security

The app runs on Vercel serverless functions. Data is stored in Supabase Postgres (AWS us-east-1). Rate limiting uses Upstash Redis. Payments run on Stripe. See Subprocessors.

All traffic uses TLS (HTTPS only). Database storage and backups are encrypted at rest (AES-256) by Supabase. Redis traffic uses TLS.

Row-level security is enabled on every table with no public policies. Only server code holds the service-role key, which never reaches the browser. The public API key for Supabase is not used.

Card data is entered on Stripe's hosted checkout and never touches our servers. Stripe is a PCI DSS Level 1 service provider. Webhooks are verified with Stripe's signing secret.

Email and password, Google (OAuth 2.0 with PKCE), or one-time email links. Passwords are hashed with Argon2id and must meet strength rules. Repeated failed sign-ins lock the account for 15 minutes and throttle the source IP. Email-link, verification and reset tokens are single-use, stored only as SHA-256 hashes, and expire (15 minutes, 48 hours and 1 hour). Changing or resetting a password signs out other devices, and you can sign out everywhere from Settings.

Sessions live in Postgres and are referenced by a random token in a __Host- prefixed cookie that is HTTP-only, Secure and SameSite=Lax. Only the token's hash is stored. State-changing requests must come from our own origin.

API keys are shown once and stored only as SHA-256 hashes. Keys can be revoked instantly from the dashboard. API access is limited to Growth and Enterprise workspaces and is rate limited.

Scans send prompts containing product or business names, categories and websites to OpenAI through its API. We do not send account emails. Under these providers' API terms, API data is not used to train their models by default.

We collect only what the service needs. Retention periods are in the Privacy Policy. Deletion requests are completed within 30 days.

Production secrets live in Vercel's encrypted environment variables, never in the code repository. Access to production systems is restricted to the core team. Dependencies are kept current.

We notify affected customers without undue delay, and within 48 hours where feasible, after confirming a personal data breach. Regulators are notified where the law requires it.

Report vulnerabilities to [email protected]. Please give us reasonable time to fix the issue before disclosing it, and do not access other users' data or degrade the service. We will not pursue good-faith research.