Data
| Company data | None stored on this website |
|---|---|
| Before an NDA | Codename only |
| Network address | Salted hash, never stored raw |
| Models | Values reduced to shapes before any model sees them |
Access
| Passwords | scrypt |
|---|---|
| Second factor | TOTP, RFC 6238 |
| Sign-in links | Single use, 20 minutes, stored as SHA-256 |
| Mailbox passwords | AES-256-GCM |
Transport
| HSTS | One year, subdomains included |
|---|---|
| Framing | frame-ancestors none, X-Frame-Options DENY |
| Headers | nosniff, strict-origin-when-cross-origin, camera and microphone off |
Processors
| Hosting | Fly.io, US |
|---|---|
| Database | Neon |
| Resend | |
| Inventory sheets | Google Drive |
| Models | OpenAI, Groq, NVIDIA |
What we do not claim
- SOC 2 or ISO 27001. Neither has been started.
- Third-party penetration test
- No automatic deletion on a timer