Security & Data

• Email and password sign-in with hashed credentials, plus Google sign-in.
• Sessions use short-lived access tokens with refresh rotation.
• Password reset is email-verified and time-limited.
• Roles are stored separately from profile data and checked server-side, so a user cannot escalate their own permissions.

Every table holding customer data is protected by row-level security policies scoped to the authenticated user or their workspace. There is no shared read path between accounts.

• Analyses, reports, tickets, notifications and credit balances are readable only by their owner.
• AI response caching is namespaced per user, so cached output is never served across accounts.
• Privileged operations run only in server-side code paths, never from the browser.

• All traffic is served over HTTPS with TLS.
• Data at rest is encrypted by our infrastructure providers.
• Secrets and API keys are stored in a managed secret store and are never shipped to the browser.

The application runs on managed cloud infrastructure with a managed PostgreSQL database, automated backups and provider-level network protection. Server-side functions execute in an isolated runtime with no direct filesystem access.

Card payments are handled by a PCI-DSS compliant payment processor. Full card numbers never reach our servers; we store only the metadata needed for invoicing, such as card brand, last four digits and expiry.

AI requests are made server-side to third-party model providers under agreements that prohibit training on your content. Request telemetry — model version, token counts and cost — is recorded for auditability. See AI Transparency for what the models can and cannot see.

• Application errors and failed requests are logged and reviewed.
• Administrative actions are recorded in an audit log.
• Anomalous credit consumption and repeated failures are flagged for review.

You can delete individual analyses and reports at any time. Closing your account removes your personal data, or irreversibly anonymises it, within 90 days, except where records must be retained for legal or accounting reasons. Full detail is in the Privacy Policy.

Security is a shared effort:

• We secure the platform, its infrastructure, access controls and data isolation.
• You secure your account: use a strong, unique password, protect your email account, and remove team members who no longer need access.
• You decide what content you submit — please do not paste credentials, payment data or sensitive personal information into analyses or chat.

We follow GDPR principles for personal data, as described in our Privacy Policy. We do not currently hold SOC 2, ISO 27001 or other third-party certifications, and we will not claim otherwise. If your procurement process requires specific assurances, contact us and we will tell you honestly what we can and cannot support today.

If you believe you have found a security issue, email support@bigwowtheory.com with the subject line “Security”. Please include steps to reproduce and give us reasonable time to respond before disclosing publicly. We acknowledge reports within two business days.