Sign-in routes to a sandbox. Google OAuth and Paddle checkout are unreachable until you swap to pk_live_ keys in Vercel.
Setup guide →Production receipts
Receipts capture shipped changes, verification results, remaining risks, and the next target. Trust stays tied to artifacts, not vague claims.
Receipt not found in this build. Open /receipts for the latest proof artifact.
What this page is
This page is intentionally conservative. It exists to help legal, security, procurement, and operators review the platform without hunting across multiple pages for basic answers.
We do not claim certifications, attestations, or controls we do not have. Status is stated plainly.
Security review, DPA flow, subprocessors, and contact paths live on one page for faster evaluation.
Subprocessors and infrastructure exist to operate the platform, not to widen the data surface by default.
Business-day acknowledgement and incident update expectations are written as operating policy, not marketing copy.
Certification status
| Program | Status | Notes |
|---|---|---|
| External certifications | None issued | We do not represent any certification, attestation, or audit report as complete unless it is complete. |
| Independent security review | Available by request | Security posture can be reviewed with enterprise buyers without implying a completed external certification. |
| Data processing review | Available by request | DPA, subprocessors, and processing boundaries are reviewed before production data onboarding. |
DPA request flow
Security contact and incident policy
Subprocessors
| Vendor | Purpose | Region |
|---|---|---|
| Vercel | Hosting, edge delivery, and server-side execution for the platform | Provider-managed (deployment configured) |
| Clerk | Authentication and user identity (required for account access) | Provider-managed |
| Supabase | Managed Postgres + storage for platform data persistence | Project-configured (typically US) |
| Upstash | Rate limiting and cache services | Provider-managed (region configured) |
| Paddle | Payments and subscription billing (only when purchasing a plan) | Provider-managed |
| Resend | Transactional email delivery (only when email workflows are enabled) | Provider-managed |
| OpenAI | LLM inference (only when cloud AI providers are enabled) | Provider-managed |
| Anthropic | LLM inference (only when cloud AI providers are enabled) | Provider-managed |
| Groq | LLM inference (only when cloud AI providers are enabled) | Provider-managed |
| Google AI | LLM inference + live token workflows (only when enabled) | Provider-managed |
| Tavily | Web search API (only when enabled) | Provider-managed |
| Qdrant | Vector memory store (optional; may be self-hosted) | Customer-controlled (deployment configured) |
| Browserbase | Remote browser execution (optional; used for server-side browsing and capture lanes) | Provider-managed |
| E2B | Cloud code sandbox execution (optional; used when configured) | Provider-managed |
Resources
Start with the DPA, privacy policy, terms, and direct legal or security contact paths below. If you need a rollout review, use the sales path and we will route it to the right team.