Data protection
- In transit: TLS 1.2+ on every connection; HTTPS enforced.
- At rest: database storage encrypted at the volume level.
- Credentials: authentication is delegated to Clerk. We never store plaintext passwords.
- Secrets: API keys and tokens are stored encrypted and never returned in full after creation.
- Payments: handled entirely by our payment processor. Card numbers never touch our servers.
Access control
- Role-based access control across workspaces (owner, admin, member, viewer).
- Every project is scoped to its owning account. Cross-tenant access is blocked at the query layer.
- API keys are scoped, revocable and rate limited.
- Audit logging of privileged and destructive actions.
- Least-privilege internal access; production access is limited and logged.
Application security
- Rate limiting on public and authenticated endpoints.
- SSRF protection on all outbound crawling and webhook delivery.
- Webhook payloads signed with HMAC-SHA256 so you can verify authenticity.
- Input validation and parameterised queries throughout (no string-built SQL).
- Automated test suite gating every change.
AI safety
- Your private research is not used to train shared or public models.
- Guardrails on prompts and generated output.
- Source attribution on generated insights so claims can be traced and verified.
- Quality evaluation runs continuously against generated output.
Infrastructure
- Containerised deployment with health checks and rolling restarts.
- Automated encrypted database backups with tested restores.
- Metrics, structured logging and alerting on error rates and latency.
- Data residency options (US / EU / APAC / ME) available on Enterprise.
Compliance status
We are an early-stage product and hold no third-party security certifications yet. SOC 2 and ISO 27001 are on the roadmap but not complete. We will not claim them until an auditor signs off. GDPR data-subject rights (access, export, deletion) are implemented and available today.
Reporting a vulnerability
If you find a security issue, email support@signaldart.com with the subject “Security”. Please include steps to reproduce and give us reasonable time to fix it before public disclosure.
We aim to acknowledge within 2 business days and provide a remediation plan within 10 business days. We do not currently run a paid bounty programme, but we credit reporters who ask to be credited.
Contact
support@signaldart.com · see also our Privacy Policy and DPA.