Report a vulnerability
info@growthkitai.comsubject: Security — GrowthKit AI
/Security
Security by subtraction.
Founders hand us strategy-sensitive context — what you're building, where you're weak, which market you're about to attack. The fastest way to protect data is to hold less of it, on fewer systems, with fewer hands. That's the whole architecture. Here's how it works in practice.
01The posture
Four rules we don't bend.
No security page survives contact with a clever attacker — posture does. These four rules decide every infrastructure choice we make, including the boring ones.
01 — Minimal collection
We collect the minimum.
The public waitlist asks for a name, a work email, and whether you want updates. The signed-in product stores the company context, reports, briefs, and checklist progress needed to provide it. No phone numbers, no hidden enrichment, and nothing is collected silently.
02 — Encryption in transit
Everything travels encrypted.
The site is HTTPS-only with HSTS preload — browsers refuse to ever load it insecurely. Form submissions travel over TLS end to end. There is no HTTP fallback, no mixed content, no exceptions.
03 — Small vendor surface
Few vendors, named ones.
Vercel hosts the site and functions. Supabase runs login and stores account, report, checklist, and encrypted integration data. Stripe processes subscriptions and can provide connected account metrics; Google Analytics and LinkedIn can provide connected metrics. Anthropic processes report inputs and connected summaries. Google Workspace holds mail and waitlist data; fonts and scripts load from Google Fonts and jsDelivr.
04 — Founder-only access
Access stops at the founding team.
Customer data is accessible to the founding team only, behind multi-factor authentication. No contractors with standing access, no shared logins, no analytics vendor with a copy of your brief.
02The architecture
The attack surface is the security model.
The public pages are static; signed-in product features run through a deliberately small set of serverless APIs and an access-controlled database.
Managed identity and storage. Supabase manages account authentication and the Postgres database. Row-level security limits browser reads to the signed-in owner; server writes use a service credential that is never exposed to the browser.
Encrypted connected credentials. OAuth access and refresh tokens are encrypted with AES-256-GCM before database storage. The browser receives connection status and selected account metadata, never token ciphertext or server secrets.
Payments handled by Stripe. We never see or store card numbers. Subscription payments run through Stripe, a PCI-DSS Level 1 processor — your card details go to Stripe, never to us. We store only your subscription status (which plan, and whether it's active).
Minimal browser storage. The browser stores the theme preference and the Supabase session needed to keep you signed in. Product data is fetched only after authentication.
Check our homework: run curl -I https://growthkitai.com and compare against the readout.
/response headers — live config
vercel edge
curl -I https://growthkitai.com
HTTP/2 200
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
permissions-policy: geolocation=(), microphone=(), camera=()
# no set-cookie. nothing to set.
03The inventory
Every byte we hold, itemised.
This is the complete list. If a category isn't here, we don't have it. Deletion is one email away — see our privacy policy for the formal version.
Waitlist signupsname · work email · updates pref
Where it livesAn access-controlled Google Workspace spreadsheet — the single system of record. No copies on the web host, in the codebase, or anywhere else.
How longUntil launch communications wrap up, or until you ask us to remove you — whichever comes first.
Email correspondencewhatever you choose to send
Where it livesGoogle Workspace mail, founder mailboxes only. Forwarded to no one.
How longRetained per the privacy policy; deleted on request.
Pilot briefsprivate beta participants
Where it livesSupabase stores your company profile, full report, daily briefs, generated or founder-added checklist tasks, and completion progress. Anthropic processes the supplied context and connected metric summaries to generate reports and briefs; public web search may be used. Custom task text is not sent back to the AI provider.
How longFor the duration of your pilot, plus the time needed to support it. Deleted on request when you leave.
Connected metricsStripe · GA4 · LinkedIn
Where it livesProvider OAuth credentials are encrypted in Supabase. GrowthKit reads selected account, revenue, traffic, and organization-performance metrics to prepare daily briefs.
How longUntil you disconnect the provider or ask us to delete the connection. Disconnecting removes the stored credential.
Site analyticsaggregate only
Where it livesVercel Web Analytics — page views, referrers, and configured product events. No ad pixels or cross-site advertising profiles.
How longPer Vercel's retention. It contains nothing that identifies you personally.
04Found something?
Tell us. We'll act like it matters — because it does.
Good-faith security research is welcome. Don't access data that isn't yours, don't degrade the service for others, and give us reasonable time to fix what you find before going public. Do that, and we'll work with you, not against you.
01 — Report
Email the founders directly.
info@growthkitai.com · subject: "Security — GrowthKit AI"
Include what you found, where, and how to reproduce it. Screenshots and request traces help. The report goes straight to the people who can fix it — there is no triage queue.
02 — Acknowledgement
A reply within two business days.
You'll hear back from a founder — not an autoresponder — with our read on severity and what happens next. We'll keep you posted through the fix.
03 — Credit
No bounty yet. Credit, always.
We're a private beta and don't run a paid bounty program yet. Valid reports get a named thank-you here on this page (if you want one) and our genuine gratitude — which, at this stage, includes the founders owing you a drink.
05The fine print, in plain sight
What we don't claim.
We are not SOC 2 or ISO 27001 certified. Certifications audit organisations at a scale we haven't reached — they're on the roadmap as the product matures, and we'd rather tell you that here than imply otherwise with a wall of badge icons.
We're also in private beta, which means the engine's infrastructure is still evolving. The commitments on this page are the constants. If your security questionnaire needs more than what's written here, email us — a founder will answer it honestly, including the parts where the honest answer is "not yet."