• The application and its database run on managed infrastructure in the United States (Supabase, via Lovable Cloud). We do not operate our own servers.
• All traffic is served over HTTPS. Data is encrypted in transit, and at rest by the managed database and storage layers.
• Card details never reach our servers. Checkout is handled by Stripe; we store only a purchase record and the identifiers Stripe gives us.

• Every table carrying customer data is protected by row-level security, so a query can only ever return the rows belonging to the account that issued it. Checks that span rows — is this person on that team — go through dedicated security-definer functions rather than being re-implemented per policy.
• Entitlements (what a customer has paid for) are written by exactly one thing: the payment webhook, verified against the payment provider's signature. The application can read them and cannot grant them.
• Sign-in is by emailed magic link or Google, so most accounts have no password for us to store or leak.
• API keys are stored hashed, are scoped to a single capability, and are individually revocable. A key that can score a read cannot do anything else.
• Scoring requests are metered and rate-limited per caller, which bounds both abuse and the cost of it.

• Uncaught client and server errors are recorded in our own database and emailed to us as a digest, so a broken checkout is visible within the hour rather than at the end of the month. Error reports go to no third-party vendor.
• The data pipeline reports its own freshness, and the product tells customers when a dataset is stale instead of serving stale figures as current.
• Every change runs through continuous integration — type checking, build, lint, and a check that the code shared with our server functions has not drifted — before it can ship.

The vendors that process data on our behalf, what each does, and what actually reaches it are listed in full on our Privacy Policy. There are 7 of them and the list is generated from the same source of truth this page uses, so the two cannot disagree.

We hold no security certification. We are not SOC 2 audited and we have not had an independent penetration test. If your procurement process requires either, tell us early — an external test is planned, and knowing a real deal depends on it changes when it happens.

Backup and recovery: the database runs on managed Postgres with the provider's backup facilities in place. We are still completing our own documented restore procedure, so we are not yet quoting a recovery-time commitment. Ask and we will tell you exactly where that stands rather than reciting a number we have not tested.

We are one person plus contractors, which is worth knowing when you assess us. What it means in practice: no internal team has broad standing access to customer data, and there is a documented continuity plan covering credentials and recovery so the service does not depend on one person being reachable.

If you have found a security problem, please tell us before telling anyone else. Email hello@use2ndsight.com with steps to reproduce it. Our disclosure policy is also published at https://use2ndsight.com/.well-known/security.txt.

What you can expect from us:

• An acknowledgement within 3 business days, from a person.
• An assessment and a fix timeline within 10 business days, and updates until it is closed.
• Credit for the finding if you want it, and no legal action for good-faith research that follows the rules below.

What we ask of you:

• Test only against your own account and data. Do not access, modify or exfiltrate anyone else's, and stop as soon as you have confirmed a problem exists.
• No denial of service, no load testing, no spam or social engineering of our staff or vendors, and no physical attacks.
• Give us a reasonable chance to fix it before publishing.

In scope: this website and its API, and our public server functions. Out of scope: our vendors' own infrastructure — report those to the vendor — along with findings from automated scanners with no demonstrated impact, missing hardening headers with no exploitable consequence, and anything requiring a compromised device or a browser we do not support.

We do not run a paid bug bounty. We will say thank you properly, publicly if you prefer, and we will fix what you find.