Security
Built for confidential work from day one.
Board numbers, client findings and pipeline data deserve care. This page lists only the controls that are in place today, and says plainly what isn't.
In place today
How we protect your data.
Row-level security on every tenant table
Every table that holds customer data is protected by row-level security in the database, so one workspace can't read another's decks, sources or usage.
Private storage buckets
Uploads and exports are kept in private storage buckets. Files are reached only through the app's authenticated download route, never through public links.
Sandboxed document parsing
Uploaded documents are parsed in isolated processes with size and format limits before any AI model sees their content.
No training on your content
We use model providers through their APIs, under terms that exclude training on customer content. We don't reuse your content for anyone else.
Security headers and CSP
Every response carries security headers, including a Content Security Policy that restricts where scripts, styles and connections can come from.
Rate limiting
Sign-in links and deck generation are rate limited, which blunts abuse such as email flooding and runaway usage.
Append-only credit ledger
Credit grants, reservations and charges are recorded in an append-only ledger that is reconciled every night.
Secrets out of the repository
API keys and service credentials are kept out of the code repository and supplied through environment configuration.
Honesty first
What we don't claim yet.
We are pre-launch. Rather than imply certifications we don't hold, here is where things stand.
SOC 2 and ISO 27001
We are not certified against SOC 2 or ISO 27001.
SSO and SAML
Single sign-on through SAML or an identity provider is not yet available.
Data processing agreement
A data processing agreement is available on request.
Sub-processors
Who processes data for us.
These providers process customer data on our behalf to run the service.
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication and file storage |
| Vercel | Application hosting |
| Anthropic / OpenAI / Google | AI models, depending on configuration |
| Stripe | Payments and billing |
Responsible disclosure
If you believe you’ve found a security issue, we want to hear about it. A security contact will be published before launch. Please don’t access data that isn’t yours or disrupt the service while testing.
Try it with work that matters.
20 free credits. No card. Review the outline before you spend any of them.