Trust · security
Security
What protects the Service and your data, as it runs today.
What we hold
The data the Service shows is republished from public records; /methodology names every source. For a subscriber we hold only what /privacy lists. Card details are entered on Stripe's own checkout page and never reach our servers.
Where it runs
On Google Cloud in the United States (region us-central1): Cloud Run serves the site and the feed, BigQuery holds the tables and Cloud Scheduler starts the daily jobs. Email goes through Google Workspace.
Secrets
The service's secrets (its admin key and the keys of the mail, payment and data services it uses) are kept in Google Secret Manager and handed to the service when it is deployed. Every deploy first scans the code and its whole history for secrets (gitleaks) and the Python packages for known vulnerabilities (pip-audit), and stops on a secret found or on a high or critical advisory.
Deploys
Deploys run from GitHub Actions, which signs in to Google Cloud through Workload Identity Federation and holds no service-account key. Each deploy runs the full test suite, starts the new version with no traffic, runs the end-to-end self-test against it and moves the traffic only when the self-test passes; the previous version keeps serving until then.
Your token
A seat's token is its key. The feed and the MCP endpoint take it in an Authorization: Bearer header, which our host's request log does not record, and that log drops every request whose address carries token=. A terminal link carries the token in its address, as a link must, and those requests are in our host's request log, kept 30 days.
Rotating and revoking
From the terminal you can rotate the token (the old one keeps working for 24 hours) or revoke it at once.
Usage
Every request a token makes is counted per seat and per day; from 1 December 2026 each plan has a daily limit.
Limits on the public pages
Requests to the public pages and to the feed are rate-limited per IP address; the counts are kept in memory only.
The website
Every page is served over HTTPS only, and browsers are told to keep to HTTPS for a year. No page can be shown inside another site's frame. A page whose address carries a token or a signed link sends no Referer header, so its address never reaches a site it links to.
Trackers
The public pages run no analytics or advertising trackers.
Who reads the data
The founder, and the AI agents that operate the Service for the founder. /privacy names every service that holds or reads personal data for us, and on what terms.