Security

SMB Deal OS is built with security as a core principle. We protect your deal data, financial intelligence, and personal information with industry-standard controls.

Infrastructure

• Hosted on Vercel with automatic TLS/SSL on all connections
• Database secured with Supabase Row Level Security (RLS) — users can only access their own data
• HSTS enabled with 2-year max-age, includeSubDomains, and preload
• Content Security Policy enforced to prevent cross-site scripting (XSS)
• All input is server-side sanitized before storage

Authentication

• Cloudflare Turnstile CAPTCHA on all authentication forms
• Multi-factor authentication (MFA/2FA) available via authenticator apps
• Progressive account lockout after repeated failed login attempts
• Automatic session timeout after 30 minutes of inactivity
• Rate limiting on all endpoints to prevent abuse

Data Protection

• All data encrypted in transit (TLS 1.3)
• Database-level row security ensures complete data isolation between users
• CSV exports are rate-limited, logged, and require confirmation
• Comprehensive audit trail for all data access and modifications

Monitoring

• Real-time anomaly detection for suspicious access patterns
• First-call detection alerts when accounts are accessed from new locations or devices
• Request-level activity tracking with source classification
• Automated security alert emails to administrators

Reporting Vulnerabilities

If you discover a security vulnerability, please report it responsibly to security@aidealradar.com. We take all reports seriously and will respond within 48 hours.