Security

Boring on purpose

No SOC II badge yet — we'll pursue certification when an enterprise deal requires it, not before. Until then, here's exactly what protects your data today.

Workspace isolation by construction

Every table is workspace-scoped with Postgres row-level security. Even a bug in our app code can't return another workspace's rows — the database refuses. The single sanctioned cross-tenant read (sector ranking) goes through one audited function with a k-anonymity floor.

Service keys never touch the browser

The Supabase service-role key lives only in server route handlers and the worker. Browser code uses the anon key, which RLS constrains to your own workspace. API tokens you generate are stored hashed (SHA-256) and shown once.

Encrypted in transit, least-privilege in practice

All traffic is HTTPS. Third-party tokens (HubSpot private-app tokens, GSC OAuth refresh tokens) sit in zero-policy RLS tables readable only by the service role — no browser query can ever select them.

AI providers see prompts, not your account

Worker runs send prompt text to OpenRouter/SerpAPI — never your email, workspace IDs, or billing details. Raw answers are stored so you can verify every citation yourself.

Questions? Read the open scoring model or run a free check — both show our work.