How we protect your account and data
We take the security and privacy of your work seriously. This page summarizes the controls we have in place. It describes our own practices and is not an independent certification.
Authentication
Accounts are protected by managed authentication with email/password and Google sign-in. Sessions use short-lived tokens, and sensitive actions are verified on the server on every request.
Access controls
Every database table enforces row-level security, so you can only read and write your own data. Premium content access is determined server-side from your verified subscription — it can't be unlocked from the browser.
Encryption
All traffic is served over HTTPS/TLS, and data is encrypted at rest by our cloud database provider. Secrets and API keys are stored in a managed secret store, never in client code.
Data & privacy
We collect only what we need to run the product: your account details, preferences, and saved opportunities. We don't sell your personal data. You can request export or deletion of your data at any time.
Payments
Payments are processed by Stripe. We never see or store your full card details. Subscription status is synced from Stripe through a signature-verified webhook.
Automated jobs
Background tasks such as scans and digest notifications run on authenticated, secret-protected endpoints so they can't be triggered or abused by third parties.
Reporting a security issue
If you believe you've found a vulnerability, please reach out so we can investigate promptly. We appreciate responsible disclosure.