DiscoveryHQ
Loading…
DiscoveryHQ
Loading…
Security
DiscoveryHQ stores what AI assistants said about your business, and what your website looks like to them. This page explains how that is kept apart from everyone else's — and, at the bottom, the things we have not done yet.
Keeping businesses apart
This is the part that matters most, so it is not left to our code remembering to be careful. It is enforced one layer down, by the database.
Each record is stamped with the business it belongs to, and row-level security is switched on for every table. The database itself refuses to hand a row to someone signed in to a different business.
Before any report, check-up or stored answer goes back to a page, the server confirms the record belongs to your business. Changing an id in the address bar returns nothing.
The check in our code and the rule inside the database are separate walls on purpose. A mistake in one does not open the other.
Most leaks between customers are not dramatic break-ins. They are one query somewhere that forgot to say “only this business”. Putting the rule in the database means that forgetting it returns nothing instead of returning someone else’s report. A table without that rule is treated as a bug in this codebase, not a shortcut.
Signing in
Logging in is the door to everything else, so we use a provider whose whole job is doors, and we keep the key somewhere the page cannot reach.
Sign-in is handled by Supabase Auth, our authentication provider. You can use an email address or your Google account. We do not build our own login system, because a homemade one is the easiest thing in software to get wrong.
The sign-in is kept in an httpOnly cookie. Your browser sends it back to us automatically, but scripts running on the page cannot read it — which is what stops a stray script from walking off with a session.
No sign-in tokens and no personal details are ever written to your browser's local storage. That is a project rule, not a preference: anything kept there can be read by any script on the page.
The plumbing
None of this is clever. It is the ordinary set of things that should be true, said out loud so you can check it.
Every connection to DiscoveryHQ uses HTTPS. Nothing moves between your browser and us in plain text.
Data lives in Postgres at Supabase, a managed provider, and is encrypted on their disks. We do not run database servers of our own.
The API keys for the AI providers live in server environment variables. They are never written into the code, never bundled into a page, and never sent to the browser.
The site runs on Vercel and the database on Supabase. Both are managed providers, so their security teams patch and maintain the machines rather than us.
Input we do not trust
Two things enter this product from outside: what an AI model writes, and what a web page contains. Neither is trusted, and neither is passed along as-is.
An AI answer is free text, and free text can contain anything at all. Before it is stored or shown, it is read into a strict shape we defined in advance — these fields, these types — and whatever does not fit is dropped.
The pages we read are raw HTML from the open web, so they get the same treatment. We pull out the specific facts a check needs and discard the rest. Raw page code never travels onward through the product.
This is a security wall, not tidiness. Text that travels untouched from a model, or from a stranger’s web page, into your report is exactly how hidden instructions and unwanted code get carried in. Checking every piece against a shape we decided in advance, and throwing away the rest, is the wall — so we treat it as one and it does not get trimmed to save time.
Less to lose
Some of the strongest security here is not a feature. It is a set of things the product deliberately cannot do.
Payments run through Stripe. Your card is entered on Stripe’s own payment page, not ours — no card number, expiry or security code ever touches a DiscoveryHQ server or database, so there is none here to lose.
We write the fix and you paste it in yourself. DiscoveryHQ has no way to change your site, so there is no write access sitting around for anyone to take over.
There is no scheduler in the product. A check-up happens when you ask for one, so nothing is quietly reaching out to your website or to AI providers in the background.
Found a weakness?
If you have found a way to get at something you should not be able to reach, we would rather hear it from you than read about it later.
Email us with what you found and the steps to see it happen. Please give us a fair chance to fix it before you share it publicly — that is what responsible disclosure means, and it protects the businesses using the product while the hole is open.
Security reports
We will acknowledge your report and work through the fix with you. We are a small team, so we are not going to print a response time we cannot promise to keep — but a real person reads that inbox and security mail goes to the front of it.
One ask in return: please do not test in ways that delete data, break the service, or reach into another business’s account. Show us the door is open; you do not need to walk through it.
What we have not done yet
Security pages usually only print the good news. Here is the other half, because you should be able to judge us on what is missing as well as what is there.
No outside firm has reviewed this code or tested it for weaknesses. If that changes, this page will say who did it and when.
We hold neither certificate, and we are not going to hint otherwise with a badge in the footer. It belongs to a later, larger version of this company.
There is no formal programme and no reward table. Reports by email are still genuinely welcome, and we will credit you if you would like that.
We do not publish an uptime figure or a service-level agreement, because we have not been running long enough for either number to mean anything.
DiscoveryHQ does not claim any security certification, audit or accreditation, and nothing on this site should be read as one. Everything above describes how the product is actually built today. For who handles your data and what we do with it, see Compliance.
DiscoveryHQ is developed and operated by Loom Labs AI LLC.
A free check-up takes a minute or two. No account needed to run it, and a free account saves the report.