// security

Security

Data security is treated as a design requirement, not as an option bolted on afterwards.

Last updated: August 2026

Encrypted traffic

All traffic between your browser and FormulAI runs over HTTPS. Exchanges with the database and the AI provider are encrypted in transit as well.

Data isolation

Every record (profile, history) is protected by row-level access rules in the database: a user can only read and write their own rows. Contact messages can only be read by an identified administrator.

Keys and secrets

AI provider API keys are never exposed in the browser: calls go through a server function that holds the secrets on the infrastructure side.

Authentication

Sign-in uses email/password or Google. Passwords are stored hashed by our authentication provider; we never see them in clear text.

Reporting a vulnerability

If you believe you found a flaw, contact us through the support page with a reproducible description. We acknowledge within 72 hours and keep you posted until it is fixed.