Security
Security commitments for the BrandGenius AI beta.
This page describes the practical controls we rely on today. It is not a certification page and should not be read as a promise of any specific compliance framework.
Authentication and access control
Workspace access is authenticated through Supabase Auth, protected routes require a signed-in user, and brand-scoped actions use server-side access checks before data is returned or modified.
Application protections
The app uses rate limiting, CSRF protection, scoped integration access, and audit or activity logging on key flows such as scheduling, review actions, support escalation, and administrative operations.
Secrets and integrations
Connected destination credentials are intended to be stored securely and only used for requested publishing-related actions. Because the product is still in beta, we recommend connecting only the destinations required for current workflows and reviewing permissions periodically.
Report an issue
Security concerns can be reported to [email protected]. Please include reproduction detail, affected workspace or route, and any relevant timestamps.