Security

Security & Trust

How we protect your data and maintain the integrity of our market intelligence platform.

Infrastructure

Enterprise-Grade Foundation

Built on industry-leading providers with extensive security certifications.

Application Hosting

Vercel Edge Network

SOC 2 Type II certified

ISO 27001 certified

Global edge deployment

DDoS protection included

Automatic SSL/TLS

Database & Storage

Supabase (PostgreSQL)

SOC 2 Type II certified

Row-level security (RLS)

Automated daily backups

Point-in-time recovery

Encrypted at rest (AES-256)

Payment Processing

Stripe

PCI DSS Level 1 certified

SOC 2 Type II certified

We never store card data

3D Secure support

Fraud detection included

Email Communications

Resend

SOC 2 Type II certified

DKIM/SPF/DMARC configured

TLS encryption in transit

No email content storage

Error Monitoring

Sentry

SOC 2 Type II certified

PII scrubbing enabled

0.1% sample rate (minimal data)

No user content stored

Server and client error tracking

Data Pipeline

GitHub Actions

SOC 2 Type II certified (GitHub)

Secrets stored in encrypted vault

Automated daily collection

No customer data in pipeline

Audit logs retained

Data Protection

Your Data, Protected

Encryption — In Transit

TLS 1.2+ for all connections (TLS 1.3 preferred)

HSTS enforced (1 year)

Certificate transparency

Encryption — At Rest

AES-256 encryption

Encrypted backups

Key management via provider

Access Control

Role-based access control (RBAC)

Principle of least privilege enforced

API keys hashed before storage

Session tokens expire automatically

Service role key never exposed to client

Data Handling

Only necessary data collected

No advertising trackers or pixels

No sale or sharing of customer data

Market data aggregated and anonymized

Data retained only while account active

All data stored and processed in the United States

Disaster recovery via automated backups and multi-region CDN

Application Security

Hardened By Default

Security Headers

Content-Security-Policy (CSP)

Strict-Transport-Security (HSTS)

X-Frame-Options: DENY

X-Content-Type-Options: nosniff

Referrer-Policy: strict-origin-when-cross-origin

Authentication

Secure password hashing (bcrypt)

Secure session management

CSRF protection

Rate limiting on auth endpoints

Secure password reset flow

API Security

API keys unique per user and hashed

Rate limiting on auth and API endpoints

All responses include security headers

Input validation on all endpoints

SQL injection protection via parameterized queries

Infrastructure

Hosted on Vercel (SOC 2 compliant)

Database on Supabase (SOC 2 compliant)

Automated deployments via CI/CD

Environment secrets never in code

Daily automated backups

Development

Secure Practices

Dependency management: Dependencies monitored and updated regularly for known vulnerabilities

Pre-deploy verification: All changes pass automated linting, type checking, and build verification before deployment

CI/CD pipeline: Automated linting, type checking, and build verification

Environment separation: Strict separation between development and production

Secret management: All secrets stored in secure environment variables, never in code

Incident Response

Response Commitments

We maintain incident response procedures to quickly identify, contain, and remediate security issues.

Acknowledgment: Security reports acknowledged within 24 hours

Assessment: Initial severity assessment within 48 hours

Communication: Affected customers notified promptly

Resolution: Critical issues prioritized for immediate remediation

Post-incident: Root cause analysis and preventive measures

Compliance

Compliance Roadmap

While our infrastructure providers maintain SOC 2 and other certifications, we are building toward our own compliance certifications.

Current

Provider-Certified

All infrastructure providers hold SOC 2 Type II

Planned

SOC 2 Type I

Under evaluation

Future

SOC 2 Type II

As customer base grows

Disclosure

Responsible Disclosure

Report to: lucas@aiminingco.com — include "Security Report" in the subject line

Safe harbor: We will not take legal action against researchers who report vulnerabilities in good faith and follow this policy

Scope: The aiminingco.com domain and all associated API endpoints. Third-party services (Supabase, Stripe, Vercel) are out of scope — report directly to those providers

Expectations: Do not access, modify, or delete other users' data. Do not perform denial-of-service testing. Do not publicly disclose vulnerabilities before we have had a reasonable opportunity to address them

Response timeline: We will acknowledge receipt within 24 hours and provide an initial assessment within 48 hours

Recognition: With your permission, we will credit you for valid vulnerability reports

Security Contact

For security concerns, vulnerability reports, or questions about our security practices, contact us directly at lucas@aiminingco.com or through our contact page.

lucas@aiminingco.com Contact Page

Last updated: April 24, 2026. This page is provided for informational purposes and is subject to our Terms of Service and Privacy Policy.

Security

Security & Trust

How we protect your data and maintain the integrity of our market intelligence platform.

Infrastructure

Enterprise-Grade Foundation

Built on industry-leading providers with extensive security certifications.

Application Hosting

Vercel Edge Network

SOC 2 Type II certified

ISO 27001 certified

Global edge deployment

DDoS protection included

Automatic SSL/TLS

Database & Storage

Supabase (PostgreSQL)

SOC 2 Type II certified

Row-level security (RLS)

Automated daily backups

Point-in-time recovery

Encrypted at rest (AES-256)

Payment Processing

Stripe

PCI DSS Level 1 certified

SOC 2 Type II certified

We never store card data

3D Secure support

Fraud detection included

Email Communications

Resend

SOC 2 Type II certified

DKIM/SPF/DMARC configured

TLS encryption in transit

No email content storage

Error Monitoring

Sentry

SOC 2 Type II certified

PII scrubbing enabled

0.1% sample rate (minimal data)

No user content stored

Server and client error tracking

Data Pipeline

GitHub Actions

SOC 2 Type II certified (GitHub)

Secrets stored in encrypted vault

Automated daily collection

No customer data in pipeline

Audit logs retained

Data Protection

Your Data, Protected

Encryption — In Transit

TLS 1.2+ for all connections (TLS 1.3 preferred)

HSTS enforced (1 year)

Certificate transparency

Encryption — At Rest

AES-256 encryption

Encrypted backups

Key management via provider

Access Control

Role-based access control (RBAC)

Principle of least privilege enforced

API keys hashed before storage

Session tokens expire automatically

Service role key never exposed to client

Data Handling

Only necessary data collected

No advertising trackers or pixels

No sale or sharing of customer data

Market data aggregated and anonymized

Data retained only while account active

All data stored and processed in the United States

Disaster recovery via automated backups and multi-region CDN

Application Security

Hardened By Default

Security Headers

Content-Security-Policy (CSP)

Strict-Transport-Security (HSTS)

X-Frame-Options: DENY

X-Content-Type-Options: nosniff

Referrer-Policy: strict-origin-when-cross-origin

Authentication

Secure password hashing (bcrypt)

Secure session management

CSRF protection

Rate limiting on auth endpoints

Secure password reset flow

API Security

API keys unique per user and hashed

Rate limiting on auth and API endpoints

All responses include security headers

Input validation on all endpoints

SQL injection protection via parameterized queries

Infrastructure

Hosted on Vercel (SOC 2 compliant)

Database on Supabase (SOC 2 compliant)

Automated deployments via CI/CD

Environment secrets never in code

Daily automated backups

Development

Secure Practices

Dependency management: Dependencies monitored and updated regularly for known vulnerabilities

Pre-deploy verification: All changes pass automated linting, type checking, and build verification before deployment

CI/CD pipeline: Automated linting, type checking, and build verification

Environment separation: Strict separation between development and production

Secret management: All secrets stored in secure environment variables, never in code

Incident Response

Response Commitments

We maintain incident response procedures to quickly identify, contain, and remediate security issues.

Acknowledgment: Security reports acknowledged within 24 hours

Assessment: Initial severity assessment within 48 hours

Communication: Affected customers notified promptly

Resolution: Critical issues prioritized for immediate remediation

Post-incident: Root cause analysis and preventive measures

Compliance

Compliance Roadmap

While our infrastructure providers maintain SOC 2 and other certifications, we are building toward our own compliance certifications.

Current

Provider-Certified

All infrastructure providers hold SOC 2 Type II

Planned

SOC 2 Type I

Under evaluation

Future

SOC 2 Type II

As customer base grows

Disclosure

Responsible Disclosure

Report to: lucas@aiminingco.com — include "Security Report" in the subject line

Safe harbor: We will not take legal action against researchers who report vulnerabilities in good faith and follow this policy

Scope: The aiminingco.com domain and all associated API endpoints. Third-party services (Supabase, Stripe, Vercel) are out of scope — report directly to those providers

Response timeline: We will acknowledge receipt within 24 hours and provide an initial assessment within 48 hours

Recognition: With your permission, we will credit you for valid vulnerability reports

Security Contact

For security concerns, vulnerability reports, or questions about our security practices, contact us directly at lucas@aiminingco.com or through our contact page.

lucas@aiminingco.com Contact Page

Last updated: April 24, 2026. This page is provided for informational purposes and is subject to our Terms of Service and Privacy Policy.