Security at Cearsi AI is a shared responsibility between the Cearsi team, the managed platforms we build on, and you as a user. This page describes the technical and organizational controls we currently rely on and the practices we ask of you. It is provided for transparency and is not a certification, audit report, or attestation against any specific framework.
1.Authentication
1.1Sign-in
Cearsi accounts are protected by email and password authentication provided by our managed identity provider. Passwords are stored as salted bcrypt hashes; we never store, transmit, or log plaintext passwords. Password reset links are single-use and time-limited.
1.2Sessions
Sessions are issued and rotated by our identity provider using short-lived signed access tokens paired with rotating refresh tokens. Signing out revokes the active session on that device. We recommend signing out on shared devices.
2.Data in transit and at rest
2.1In transit
All traffic to cearsi.dev is served over HTTPS/TLS 1.2 or higher with HSTS enforced at the edge. Internal service-to-service calls to our managed providers (database, auth, payments, AI gateway) are also encrypted in transit.
2.2At rest
Application data is stored with our managed Postgres provider (Supabase), which encrypts data at rest with AES-256 by default. Automated backups are encrypted using the same keys and retained on a rolling window before being overwritten.
3.Access controls
3.1Least privilege
Access to production systems is limited to members of the Cearsi team who need it to operate the Service. Access is reviewed periodically and revoked when no longer required. Administrative accounts for the identity provider, database, payments, and hosting console require multi-factor authentication.
3.2Tenant isolation
Postgres row-level security ("RLS") policies scope user data to the account that owns it, so users cannot read or modify each other's records through the API. Privileged server-side operations use narrowly scoped functions that verify the caller's role before touching admin capabilities.
3.3Secrets
API keys, webhook signing secrets, and third-party credentials are stored in a managed secret store, injected at runtime, and never committed to source control. Publishable/anon keys used in the browser are non-privileged and enforced by RLS.
4.Infrastructure and hosting
The Cearsi web app and API run on Cloudflare's global edge network. Managed database and authentication run on Supabase (backed by AWS). AI model inference is routed through our AI gateway to third-party model providers under written data-processing agreements. These providers maintain physical, environmental, and network controls for their data centers and publish their own security documentation, including SOC 2 and ISO 27001 reports.
5.Payments and PCI
Payments are handled entirely by Stripe, a PCI-DSS Level 1 certified payment processor, through embedded checkout components. Card details are transmitted directly from your browser to Stripe and never touch Cearsi servers. Cearsi does not store full card numbers, CVCs, or bank credentials. We receive only the limited billing details required to manage your subscription. Stripe webhooks are verified using signed timestamps to prevent replay and forgery.
6.Logging and monitoring
We collect application logs, error reports, and basic performance metrics to detect failures and abuse. Application diagnostic logs are retained for up to 90 days; security and audit logs for up to 12 months. Access to logs is restricted to authorized team members. We do not intentionally log passwords, full payment credentials, or the bodies of AI conversations in production logs.
7.Software development practices
- Source code is stored in a private repository with access controls;
- Automated dependency, static-analysis, and RLS security checks run against changes before release;
- Production deployments go through a controlled release pipeline;
- We aim to apply security patches to dependencies promptly after they are published;
- Database schema changes are versioned through reviewed migrations that require RLS policies for every user-facing table.
8.Incident response
If we become aware of a security incident affecting your personal data, we will investigate, take steps to contain and remediate it, preserve relevant evidence, and notify affected users and, where required, supervisory authorities without undue delay and in any event within the timeframes required by applicable law (for example, within 72 hours of becoming aware under GDPR Article 33 where the incident meets that threshold).
9.Your responsibilities
- Use a strong, unique password and do not reuse it on other sites;
- Keep the email account tied to Cearsi secure, ideally with multi-factor authentication enabled at your email provider;
- Sign out on shared or public devices;
- Do not share your credentials, session tokens, or API keys with anyone;
- Rotate any Cearsi-issued API keys you believe may have been exposed;
- Notify us immediately at support@cearsi.dev if you suspect unauthorized access.
10.Reporting a vulnerability
If you believe you have found a security issue in Cearsi, please email support@cearsi.dev (Subject: "Security Report") with a description, the affected URL or feature, and steps to reproduce. Please include any proof-of-concept privately and avoid actions that could harm users or degrade the Service — including denial-of-service testing, data exfiltration beyond what is needed to demonstrate the issue, social engineering of Cearsi staff or vendors, physical attacks, and testing on accounts you do not own. Testing against accounts and data you own or have explicit permission to test is acceptable.
We will acknowledge valid reports within 5 business days and work with you toward a resolution. We ask that you give us at least 90 days to address the issue before any public disclosure. Good-faith research conducted consistently with this policy will not be pursued by Cearsi under the Computer Fraud and Abuse Act or similar laws. We do not currently operate a paid bug bounty program.
11.Compliance
Cearsi is not currently certified against SOC 2, ISO 27001, HIPAA, PCI-DSS, or similar standards. Our payment processor is independently PCI-DSS Level 1 certified, and our hosting and database vendors publish their own SOC 2 and ISO 27001 reports. Cearsi is not a covered entity or business associate under HIPAA; do not submit protected health information to the Service. If your organization needs additional coverage or a data-processing addendum, contact us and we will discuss what we can and cannot provide.
12.Changes to this page
We may update this Security page as our practices evolve. Material changes will be reflected by the "Last updated" date above.
13.Contact
General security questions: support@cearsi.dev.