Trust Center · Security
Security at ThinkToAction
Security is an ongoing discipline. This page separates safeguards implemented in the application from production controls that still require configuration and evidence.
Authentication
The application implements a managed Supabase email-and-password architecture, server-side session validation, and protected account routes. Live identity-provider configuration is complete and in production; end-to-end email delivery has not yet been independently confirmed with a live test.
Passwords
The application is designed not to store password hashes itself. Password hashing and recovery are delegated to the configured identity provider. A full third-party security audit of its production settings has not been performed.
Encryption
Session cookies are designed to be HTTP-only, SameSite=Lax, and Secure in production. Encryption in transit and at rest depends on the final hosting, database, and provider configuration; it has not been independently verified here.
Sessions
Protected routes validate sessions on the server. Account controls include global sign-out and session visibility by design. Final token lifetimes, revocation behavior, and multi-device acceptance require live testing.
Rate limiting
Account and AI routes include request-size limits, validation, bounded execution, and rate-limit designs. Distributed production behavior depends on the deployed database and infrastructure.
Infrastructure
Application secrets are intended to remain server-only. Database row-level policies isolate learner-owned records. No claim is made about a final region, penetration test, SOC 2, ISO certification, or audited control environment.
Backups and recovery
Backup schedules, restore tests, recovery objectives, and deletion from backups have not been approved or verified. Documenting these against the live provider configuration remains an ongoing priority.
Privacy
Security protects privacy but does not replace data minimization. External AI receives relevant text only after an explicit request and only when configured. Learners should not submit secrets or sensitive workplace information.
Known limitations
Important work remains as ongoing priorities.
- Live Supabase migration and authentication are complete; row-policy, export, and deletion acceptance testing remains incomplete.
- Monitoring, alerting, incident notification, penetration testing, and dependency remediation are not documented as operational.
- A monitored security contact is configured; no formal responsible-disclosure policy or bug-bounty program is published yet.
- Backup, restore, encryption, region, and vendor evidence remains to be verified.
Responsible disclosure and security reporting
Do not publish passwords, tokens, personal information, or exploit details. A private monitored security contact is available; see contact-channel status for the current destination. A formal acknowledgement process, severity triage, and response-time commitment have not yet been published.
What customers can do
- Use a unique password and protect access to your email account.
- Sign out on shared devices and revoke sessions you do not recognize.
- Keep secrets, credentials, confidential documents, and sensitive personal information out of learning fields.
- Install browser and operating-system security updates.
- Report suspected security issues privately using the configured security contact.
Future improvements
Priorities include documented backup and recovery tests, production monitoring, incident response, dependency review, security testing, and a formal responsible-disclosure process.