Security
Your competitive picture is the whole point of keeping it private.
Who you watch says as much about your strategy as what you find. This page says how that is protected, in enough detail to check rather than to reassure.
Tenant isolation
Enforced by the database, not by remembering.
Most multi-tenant bugs are one missing WHERE clause. The design assumes
that will eventually happen and makes it harmless.
Row-level security on every table
PostgreSQL policies scope every read and write to one tenant, set once per database session. A query that forgot its filter returns nothing rather than someone else’s data.
The application cannot bypass it
It connects as a role with no superuser rights, no bypass privilege and no ability to create or drop anything — so it cannot remove a policy even in principle. Schema changes run under separate credentials.
Proved, not asserted
There is a test that borrows the same pooled connection alternately as two different tenants, six times over, and checks neither can see the other — because a connection returned to a pool carrying the previous tenant’s context would be exactly the kind of leak nobody notices.
Credentials and keys
What is stored, and how.
Integration credentials are sealed
Slack tokens, CRM refresh tokens and webhook URLs are encrypted at rest with AES-256-GCM before they reach the database — authenticated encryption, so a tampered value fails to open rather than quietly decrypting to something else. Each stored secret records which key version sealed it, so keys can be rotated without a migration window and without invalidating anything.
Passwords
Hashed, never stored or logged in any recoverable form. Sessions are short-lived signed tokens, and every user has a token version that can be bumped to invalidate every token they hold immediately — which is what makes “sign everyone out” a thing that actually works.
Your data leaves only where you send it
Collected content and the readings drawn from it are sent to the model provider that performs the analysis, and to the destinations you configure — your Slack, your CRM, your webhook. Nowhere else. There is no data sharing between accounts, and your competitor list is never used to build anything for anyone else.
Export is available on every plan and there is a public API from Growth upwards. It is your competitive picture; it should not be hostage to a subscription.
How we collect
A crawler that behaves itself.
Two reasons this matters: it is the right way to treat someone else’s server, and a tool that gets you blocked or complained about is a liability rather than an advantage.
Public pages only
Nothing behind a login, nothing bought from a data broker, and no pretending to be a prospect to get a demo or a quote. If you could not have found it yourself with a browser, it is not in here.
Polite by default
robots.txt honoured in full including crawl-delay, one request at a time per host, conditional requests so an unchanged page costs a single 304, and an honest user agent with a link explaining what it is.
Tenant-supplied URLs are not trusted
Anyone can type a URL into this product, so every fetch is checked twice — once before the request and again against the address it actually resolved to, which is the check that catches a hostname pointing somewhere private on the second lookup.
Operational practice
The unglamorous parts.
- Encrypted in transit and at rest. TLS everywhere, including to the database. Managed PostgreSQL with encryption at rest and automated backups.
- Least privilege, on purpose. The application role cannot create a table, drop a policy or read another tenant’s rows. Administrative credentials are separate and are used by one process, at start-up, for migrations.
- Containers run unprivileged. No root, no writable application volume, nothing persisted to local disk — everything of consequence is in the database.
- Audit trail. Account and integration changes are recorded, and the log is readable on higher plans.
- Secrets are never in the repository. They are injected at runtime, and nothing writes them back out — including error messages, which are written specifically not to quote a connection string back at you.
Reporting something
If you believe you have found a vulnerability, please write to [email protected] with enough detail to reproduce it. We will confirm receipt, keep you updated, and will not take action against anyone reporting in good faith.
What this page is not
It is not a compliance certification. We are a young product and do not hold SOC 2 or ISO 27001 today. If your procurement process needs either, say so when you get in touch rather than discovering it late — [email protected].
Questions we have not answered here?
Ask directly. A security question deserves a specific answer rather than a brochure.