Security

• Authentication is handled by a managed provider (Supabase). Passwords are never stored in plain text.
• Email verification is required before you can use the product.
• Sessions use secure, HTTP-only cookies validated on every request.
• Each account can only access its own data; server-side checks enforce this on every request.

• All traffic is served over HTTPS.
• Data is stored in a managed Postgres database with access restricted to the application's server-side credentials.
• Billing is handled by Stripe; we do not store full card numbers.
• Secret keys are kept server-side and are never exposed to the browser.

Subscription events from Stripe are verified using signed webhooks and de-duplicated so they cannot be replayed to change your billing state.

If you believe you have found a security vulnerability, please report it to [to be completed by the operator]. We ask that you give us a reasonable opportunity to address the issue before any public disclosure, and that you avoid accessing or modifying other users' data.

Security is continuous. We are actively strengthening areas such as multi-factor authentication and audit logging. If a specific control is important to your organization, contact [to be completed by the operator].