Trust & Security

All card payments are processed by Stripe, a PCI-DSS Level 1 certified payment provider.

• We never see, handle, or store your full card number; it goes directly to Stripe.
• Checkout runs on Stripe's secured infrastructure.
• We retain only a reference to the transaction, never raw payment credentials.

Your account is protected with modern, well-understood security:

• Passwords are hashed with scrypt and a per-user salt, and we never store them in plain text and cannot recover them.
• Sessions use a signed, HttpOnly, Secure cookie with a server-enforced expiry; your raw password is never placed in the cookie.
• Database access is default-deny (row-level security), so account records are unreachable by anonymous requests.
• Sign-in and sign-up are rate-limited to resist automated attacks.

We build on established, attested infrastructure rather than rolling our own:

• Hosting and delivery: Vercel.
• Database and storage: Supabase (managed PostgreSQL) with row-level security.
• Transactional email: Resend, sent from our verified domain.
• Analytics are first-party and cookieless, with no third-party advertising trackers.

We are not currently SOC 2 or ISO 27001 certified, and we don't claim to be. We inherit the security attestations of our infrastructure providers (Vercel, Supabase, Stripe, Resend) and design security into the product from the start. As the business matures we will pursue formal attestations and update this page.

For how we handle personal data and your rights, see our Privacy Policy, Cookie Policy, and Compliance pages.