Security Overview

1. Current safeguards

• HTTPS encryption in transit through Vercel and managed providers.
• Clerk-managed authentication and account-session controls.
• Server-side authorization checks and project ownership boundaries.
• Supabase Postgres and Storage in East US (Ohio), with row-level security and private storage controls where applicable.
• Server-only provider credentials and restricted administrative database access.
• File type, size, count, and processing limits for Startup Memory and community uploads.
• OpenRouter requests configured to deny data collection and require eligible zero-data-retention inference endpoints.
• Client-side encryption for one-to-one message bodies using a device-side private key.
• Usage limits, validation, abuse controls, and security-oriented logging around sensitive endpoints.

2. Direct-message encryption boundary

FounderRoute stores direct-message ciphertext, wrapped keys, participant identities, timestamps, reactions, and read state. It does not store the browser private key needed to read message bodies. A recipient can still copy a message, and losing a device key can make previous messages unrecoverable. This feature should not be treated as a substitute for a dedicated regulated communications system.

3. No certification or absolute guarantee

FounderRoute does not currently claim SOC 2, ISO 27001, HIPAA, PCI DSS certification, penetration-test certification, or a formal uptime SLA. Provider certifications apply to those providers’ systems and do not automatically certify FounderRoute. We do not guarantee that incidents, loss, or unauthorized access can never occur.

4. Your security responsibilities

Use a secure authentication method, protect your devices, review connected integrations, remove access you no longer need, avoid uploading secrets or regulated sensitive data, verify recipients before sharing, and report suspected compromise promptly. You are responsible for lawful backup or export of information you cannot afford to lose.

5. Responsible security reporting

Researchers may report a suspected vulnerability through the in-app support channel or email security@founderroute.app. Include a clear description, affected URL or feature, reproducible steps, potential impact, and evidence that does not expose another person’s data.

Good-faith research must avoid privacy violations, social engineering, denial of service, destructive testing, persistence, public disclosure before a reasonable remediation period, and access beyond the minimum needed to demonstrate the issue. We do not currently operate a paid bug-bounty program.

6. Incidents

We investigate credible security events, work with affected providers, contain and remediate issues, and notify affected users or authorities when required by law. Notification timing and detail may depend on investigation, safety, law-enforcement, and provider constraints.