1. Security Principles & Architecture
Radarly AI was architected from inception around principles of data minimization, credential isolation, and defense in depth. We ensure that user sensitive credentials remain in user hands while deploying enterprise security controls across our web and database tiers.
Encryption in Transit
All communications between your browser, our servers, and third-party APIs are encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS) with strict HSTS headers.
Zero Server Token Retention
Your Telegram Bot Tokens and personal Gemini API keys reside exclusively in your client-side browser storage. Our primary databases do not store your private bot secrets.
Zero Model-Training Isolation
When synthesizing pitches via Google Gemini, payloads are transmitted under commercial API terms ensuring your proposal context and persona data are never retained to train foundation models.
Row Level Security (RLS)
Our Supabase PostgreSQL databases enforce granular Row Level Security (RLS) policies. User records are strictly inaccessible across tenants, ensuring complete profile isolation.
2. Authentication & Credential Storage
User authentication is provided via Supabase Auth:
- Password Hashing: Passwords are never stored in plaintext. They are salted and hashed using industry-standard bcrypt/Argon2 algorithms.
- OAuth 2.0 PKCE: Social authentication (Google OAuth) utilizes Proof Key for Code Exchange (PKCE) flow to safeguard against interception attacks.
- Token Handling: Session tokens are securely managed with short expiration intervals and automatic background refresh rotation.
3. Payment Security & Financial Isolation
Radarly AI operates with zero access to cardholder data. All payment transactions are conducted through authorized third-party payment gateways over encrypted SSL/TLS connections. Credit card details are never processed, transmitted, or stored on Radarly servers.
4. Infrastructure Protection & Rate Limiting
To prevent automated abuse, denial-of-service, and credential stuffing:
- Sliding-window IP and account rate-limiters are enforced across all public and authenticated endpoints.
- Edge reverse proxies automatically filter malicious bot signatures and malformed payloads.
- Continuous automated vulnerability scanning is deployed across npm dependencies and runtime containers.
5. Vulnerability Reporting & Responsible Disclosure
We welcome vulnerability reports from independent security researchers. If you identify a potential security vulnerability within the Radarly AI application or API infrastructure:
Responsible Disclosure Channels
Please email: radarlytech@gmail.com
Include a detailed summary with reproducible steps. Please allow our security team reasonable time to evaluate and remediate the issue prior to public disclosure.
Have questions regarding this policy?
Our support team typically replies within 1 to 2 business days.