1. Overview
We build security in from the start: least-privilege access to data, encrypted transport everywhere, payments handled by a PCI-compliant processor so we never touch card numbers, and continuous monitoring so we know quickly when something is wrong.
2. Data protection
- Encryption in transit. All traffic is served over HTTPS/TLS.
- Row-level security (RLS). Our database enforces tenant isolation — each customer can access only their own records, at the database layer.
- Restricted secrets. Server-side keys and secrets are held in the hosting platform’s encrypted environment, not in client code, and access is limited.
- Data minimization. We collect only what we need (see the Privacy Policy) and let you delete it yourself.
3. Authentication
Sign-in is passwordless — one-time email codes and magic links — which removes the risk of reused or weak passwords. Sessions are scoped to your workspace, and you’re responsible for keeping your email account secure. Team access is invitation-based and owner-controlled.
4. Payments
We never see or store your full card number. All payments are processed by Stripe.
Card data is captured directly by Stripe, a PCI-DSS Level 1 payment processor. We receive only the tokens and metadata we need to fulfill your order and manage billing.
5. Abuse & bot protection
We use Cloudflare Turnstile on our forms to tell humans from bots, plus rate-limiting on sensitive endpoints. These controls protect the free check, sign-in, and checkout from automated abuse.
6. Monitoring & incident response
We record server errors and notable events with full context in a durable, queryable store, with real-time alerting so a human sees serious issues quickly (and Sentry when configured). If a security incident affects your personal data, we are committed to investigating, containing it, and notifying you and regulators as required by applicable law.
7. Responsible disclosure
Found a vulnerability? We appreciate coordinated disclosure. Email support@icarusworks.aiwith details and steps to reproduce. Please don’t access other users’ data, degrade the service, or publicly disclose before we’ve had a reasonable chance to fix the issue. We won’t pursue good-faith researchers who follow these guidelines.