Security

1How data is protected

• All traffic is served over TLS. Data is encrypted at rest by our database and storage provider.
• Authentication is handled by a dedicated provider. Passwords are hashed and never stored or logged in plain text, and we never see your Google password if you sign in that way.
• Every account's data is isolated. Row-level security policies are defined on every user table as defense in depth, and ownership is enforced in the application layer on every request.
• Uploaded images are stored in a private bucket and served only to the account that uploaded them, through an authenticated endpoint — or, on a chart that account has published, through links that are signed, expire within about two hours, and work only for that chart.
• A published chart is a copy holding only what the chart draws. Its viewers are checked against the invitation list on every request, and embeds are restricted by the browser to the websites the owner allowed. Embedded charts set no cookies.
• Internal service-to-service calls are authenticated with a shared secret; there is no unauthenticated path into the job pipeline.
• Request bodies are size-capped before being read, and abuse-prone endpoints are rate limited per account.
• Secrets live in environment configuration, never in the repository. Access to production data is limited to those who need it.

2Data retention

Files you upload are deleted as soon as the pipeline has read them — normally within minutes — and a scheduled sweep removes anything left behind by a failed job within 40 minutes. Nothing you upload is placed in publicly readable storage.

The full schedule, including what survives on a finished chart and why, is in the Privacy Policy.

3Reporting a vulnerability

Email security@chartforce.ai with enough detail to reproduce the issue. We acknowledge within 3 business days, tell you our assessment within 10, and let you know when it is fixed. We are happy to credit you publicly if you would like that.

In return, please:

• Test only against your own account, and do not access, modify or delete anyone else's data.
• Do not run denial-of-service tests, spam, or social-engineering attacks against our staff or users.
• Give us reasonable time to fix an issue before disclosing it publicly.
• Do not exfiltrate data. Proving you could reach a record is enough; downloading it is not.

We do not currently run a paid bug bounty.

4If something goes wrong

If a breach affects personal data and creates a risk to the people involved, we notify affected users and the relevant supervisory authority within the deadlines the law sets — 72 hours from becoming aware, under the GDPR. Notification tells you what happened, what data was involved, what we have done, and what you should do.

5Security questionnaires

We are a small team and do not hold SOC 2 or ISO 27001 certification. We answer security questionnaires directly and will not pretend to controls we do not have. Send yours to security@chartforce.ai.