Trust center
Security overview — current controls
This page summarizes controls implemented in the application code; it is not a certification, warranty, penetration-test result, or claim of complete operational security.
Application controls
Customer APIs validate Supabase sessions and derive identity server-side. Workspace records use membership-scoped database row-level security. Responses set a content security policy, frame protection, content-type protection, strict referrer policy, and production-only HSTS. State-changing browser requests receive same-origin checks; auth, analysis, and checkout routes are rate limited; JSON bodies are bounded and validated.
Data and logs
Document upload remains disabled. Application logging is structured and limited to approved operational fields and opaque hashes; it should not contain request bodies, credentials, email addresses, workspace content, or Stripe secrets.
Account controls
Settings supports export and deletion. Deletion requires a recent authenticated session and exact typed confirmation. The workflow cancels an active Stripe subscription first or pauses for operator review, then removes customer tables in documented order and deletes the identity. Provider backups expire only under the configured provider lifecycle.
Limitations
No claim is made here about external certification, formal audit, penetration testing, uptime, backup schedule, vulnerability safe harbor, or incident notification deadline. Operational configuration and a successful restore exercise are paid-launch gates.