Security & Data Handling

Accounts and sign-in

• Email and password sign-in with hashed credentials — we never store your password.
• Sessions are held in your browser and expire automatically.
• Password reset is done through a one-time email link.

Document storage

• Uploaded packets go into a private storage bucket that is not publicly browsable.
• Each file is stored under a folder keyed to your account, and access rules reject reads from any other account.
• Files are checked to confirm they are real PDFs and are size-limited before analysis.

Database access rules

• Every table with member data has row-level rules that limit each row to its owner.
• Reports are private by default and only become readable to others when you mark them public.
• Member profiles appear to other members only when you opt in to the directory.
• Contact form submissions and newsletter signups are write-only from the public site and readable only by our server processes.

Transport and infrastructure

• All traffic is served over HTTPS.
• Server-side logic runs in an isolated runtime with secrets held outside the codebase.
• Payments are processed by Stripe; card data never touches our servers.

AI processing

Documents are sent to our AI provider only to generate your report, and are not used to train public models. The AI processing page explains the pipeline step by step.

Ongoing review

The project runs automated security scans against the database and dependency tree before each release, and findings are fixed before publishing.

Reporting a vulnerability

If you believe you have found a security issue, please tell us through the contact form with enough detail to reproduce it, and give us a reasonable window to fix it before disclosing publicly. We will not pursue action against good-faith researchers.