Server-only secrets
Provider, database, billing, webhook, and AI credentials are never included in browser bundles.
Trust centre
Security is an operating constraint.
The platform separates provider credentials, customer identity, billing state, prediction records, and public delivery surfaces.
Controls in the current architecture
Signed billing events
Stripe webhook signatures are verified and event identities are recorded idempotently in the same transaction as current entitlement state.
Hashed API keys
Syndicate keys are displayed once and persisted as SHA-256 hashes.
Safe outbound delivery
Customer webhook endpoints prove control, resolve only to public networks, are DNS-pinned per attempt, follow no redirects, and receive HMAC-signed derived-only references.
Least-data generation
AI prompts contain normalized race inputs, not provider credentials or customer billing details.
Transactional state
Multi-step ingestion, entitlement, deletion, billing-lifecycle, and receipt workflows use a session-capable database driver and rollback as one logical unit.
Rate and budget controls
Account quotas, request limits, and AI spending ceilings constrain automated usage.
Immutable analysis identity
Input hashes, model IDs, prompt versions, and generation times make records auditable.
Restricted operations
The private operator console requires an exact Clerk user-ID allowlist, and manual recovery actions are lock-protected and audited.
Responsible disclosure
Do not include credentials, personal information, or exploit payloads in public channels. A dedicated external vulnerability-intake address has not yet been published; until it is, avoid testing production beyond your own account and normal documented interfaces.
Scope limits
No website can make an absolute security guarantee. This page documents intended controls, not a certification, penetration-test claim, bug-bounty programme, or promise that every class of vulnerability has been eliminated.