Security
How we protect your data and transactions
Encryption
- HTTPS everywhere - all data transmitted between your browser and our servers is encrypted with TLS 1.3
- Database encryption - data at rest is encrypted using AES-256 through our database provider (Supabase/AWS)
- API key protection - all sensitive keys and secrets are stored as encrypted environment variables, never in source code
Payment Security
- PCI DSS compliant - all payment processing is handled by Stripe, a PCI Level 1 certified payment processor
- No card storage - we never see, store, or have access to your full card number, CVC, or expiration date
- Webhook verification - all payment event notifications are cryptographically verified using Stripe webhook signatures
- Transparent pricing - fees are calculated and shown to you before any payment is processed
Data Access Controls
- Row-level security - database policies ensure you can only access your own data; no user can view another user's bills, calls, or savings
- Authenticated API routes - every API request is validated against your active session before any data is returned
- Magic link authentication - no passwords to steal or breach; login uses secure, time-limited email tokens
AI Processing
- Real-time only - call audio is streamed to Google Gemini for live coaching and is not recorded or stored on our servers
- Minimal context - we only send the AI model what it needs: your bill category, provider, and current conversation context
- No model training - your call audio and transcripts are not used to train AI models
Infrastructure
- Hosted on Vercel - enterprise-grade hosting with automatic DDoS protection and edge network distribution
- Database on Supabase - built on AWS infrastructure with automated backups and point-in-time recovery
- Dependency monitoring - automated security scanning for vulnerabilities in our software dependencies
Report a Vulnerability
If you discover a security vulnerability, please report it responsibly. We take all reports seriously and will investigate promptly.
Email: security@billslayer.app