Security
Your competitive intelligence stays yours.
Isolation
- Every customer row carries its organization id.
- Postgres row-level security refuses cross-tenant reads even if a query forgets its filter.
- The application connects with a role that does not own the tables and cannot bypass RLS.
Authentication
- Passwords hashed with Argon2id.
- Short-lived access tokens; rotating refresh tokens with replay detection that revokes the whole session family.
- HttpOnly, SameSite cookies on a single origin, plus a CSRF header check on every write.
Access control
- Four roles — owner, admin, analyst, viewer — enforced on every endpoint.
- Scoped API keys, hashed at rest, shown once.
- Audit log of sign-ins, invitations, role changes, runs and billing events.
Data & providers
- Provider keys live only in the server environment and are scrubbed from every stored error.
- Full engine responses are kept as evidence for each answer.
- Payments are handled by Stripe; we never see card numbers.
Find out what AI tells your customers. Today.
Private beta, by invitation. Your first report in under fifteen minutes.