Security

In transit and at rest

All traffic to smartsponsor.ai is encrypted with TLS, and browsers are instructed to never downgrade (HSTS). Data lives in managed databases and object storage with encryption at rest, hosted in United States data centers.

Accounts and access

• Passwords are stored only as salted hashes, never in plain text.
• Repeated failed sign-ins lock the account temporarily and are rate limited.
• Every organization's data is isolated: queries are scoped to your organization at the data layer, and sign-in activity is kept in an audit trail.
• Payment credentials are handled entirely by Stripe and never touch our servers.

Engineering practice

• Changes ship through code review and automated test gates before deployment.
• Dependencies are monitored for published vulnerabilities and patched promptly.
• Secrets are stored sealed and encrypted — never in source code.

Reporting a vulnerability

If you believe you've found a security issue, please tell us privately through the contact form with enough detail to reproduce it. We'll acknowledge your report, investigate, and keep you informed — and we ask that you give us reasonable time to fix the issue before any public disclosure.