Security
We only describe practices we can actually verify here — no unearned certifications, no vague reassurances.
Encryption in transit
All traffic to and from the app is served over HTTPS/TLS via our hosting provider, Vercel.
Encryption at rest
Application data is stored with Supabase, which encrypts data at rest as part of its managed Postgres and file-storage infrastructure.
Authentication
Accounts are protected by Supabase Auth with hashed credentials. We never store your password in plain text.
Access controls
Every database table enforces row-level security scoped to your own account — one consumer's data is not queryable by another's session. Sensitive writes go through a separate service-role path that only our server code can reach.
Credential storage
If you connect a credit-monitoring provider, that login is encrypted (AES-256-GCM) before it's stored and is never displayed again after you enter it.
Document storage
Uploaded credit reports and identification documents are kept in private, access-controlled storage namespaced to your account — not in a shared or public bucket.
AI data handling
Dispute letters are drafted with the assistance of Anthropic. Report text sent for drafting is used only to generate that letter and is not used to train Anthropic's models, per its commercial API terms.
Data retention
Described in full in our Privacy Policy. You can request deletion of your account and personal data at any time.
Account and data deletion
Every account has a self-service "Delete my account and data" option (Settings → Danger zone) that revokes your login immediately, erases your profile, and deletes your uploaded files.
Backups
Database backups are handled by Supabase as part of its managed infrastructure. See Supabase's backup documentation for the frequency and retention that applies to our plan.
Incident response
If we become aware of a security incident that affects your personal data, we investigate and contain it as quickly as we can, and notify affected users by email without unreasonable delay, consistent with applicable law.
Third-party infrastructure
We rely on Vercel (hosting), Supabase (database, auth, file storage), Anthropic (AI letter drafting), PayPal (billing), and Resend (email delivery).
We do not currently hold SOC 2, HIPAA, or similar third-party security certifications. This page will be updated if that changes.
Report a security issue
If you believe you've found a security vulnerability, email support@approveddisputes.com with details. Please don't access or modify data that isn't your own while investigating.