Security

• Passwords are hashed with bcrypt (cost factor 12) and never stored or logged in readable form.
• Sessions use signed, expiring JSON Web Tokens held in an HTTP-only, Secure, SameSite=Lax cookie, so they are not readable by page scripts.
• Google sign-in is supported so you can avoid a separate password entirely.
• Email addresses are verified before an account can reach paid features or authorise an AI assistant.
• Password reset tokens are single-use, short-lived and stored only as SHA-256 hashes.

Our connector for AI assistants implements the Model Context Protocol authorisation spec rather than API keys pasted into a chat window:

• OAuth 2.0 authorisation code flow with PKCE (S256) is mandatory. There is no password or key for you to paste anywhere.
• Authorisation codes are single-use, expire in 10 minutes, and are stored only as hashes. Consumption is atomic, so a replayed code cannot mint a second set of tokens.
• Access tokens are short-lived (1 hour) and audience-bound to the connector endpoint, so they cannot be replayed against the web application, and web sessions cannot be replayed against the connector.
• Refresh tokens are stored only as hashes and rotate on every use. Reusing a rotated token is treated as theft and revokes the whole token family.
• Every tool is read-only and annotated as such, so a connected assistant cannot change your account, your billing or your data.
• Each tool call is logged with its outcome, which is also what enforces free-tier limits.

• All traffic is served over HTTPS/TLS. HTTP is redirected and HSTS is enabled.
• Data at rest is encrypted by our database and storage providers.
• We never see or store payment card details. Card data goes directly to Stripe, a PCI DSS Level 1 service provider.
• Secrets are held in our hosting provider’s encrypted environment configuration, not in source control.
• Access to production data is limited to the people who need it to operate the service.

The application runs on Vercel, with a managed PostgreSQL database on Neon hosted in AWS US East. File uploads are stored in Vercel Blob storage. Our full list of sub-processors, and what each one receives, is in the privacy policy.

We would rather be straight with you than imply more than we have. We do not currently hold a SOC 2 or ISO 27001 certification, and we do not claim HIPAA compliance. We do not process payment card data ourselves, and the service is not designed for special-category personal data or protected health information: please do not upload any.

Email privacy@alfabolt.com with enough detail to reproduce the issue. We aim to acknowledge within 3 business days and will keep you updated while we work on a fix.

Please give us a reasonable window to remediate before publishing, test only against accounts you own, and avoid anything that degrades the service for others or accesses other people's data. We will not pursue legal action against researchers who follow that. We do not currently run a paid bounty programme, but we are glad to credit you.

If a breach affects your personal data we will notify affected account holders and the relevant authorities as required by law, without undue delay, and tell you what happened, what data was involved and what we are doing about it.