Security & Data Protection

How we protect your data. Last updated: October 7, 2026

Encryption

Data is encrypted both in transit and at rest:

TLS: Connections use TLS 1.2 or higher
Credential Encryption: API keys and credentials for connected platforms are encrypted by our application using AES-256-GCM
Passwords: Stored only as bcrypt hashes, each with its own salt
At Rest: Data is encrypted in transit and at rest by our hosting and database providers; platform credentials are additionally encrypted by our application (AES-256-GCM)

Data Storage

Infrastructure: The application is hosted on Vercel and the database and file storage on Supabase, both in the United States
Database Security: A managed PostgreSQL database with encryption at rest and daily backups by the provider

Platform Credentials

When you connect a platform (such as Stripe, Gumroad or Lemon Squeezy):

Application-Level Encryption: All API keys and secrets are encrypted using AES-256-GCM with a random IV per value before storage
Defense in Depth: Credentials are protected by application-level encryption on top of the database provider's encryption at rest
Minimal Permissions: Our setup guides ask for the narrowest API scopes each platform offers
Read-Only Access: Where a platform supports it, a read-only key is enough
No Sharing: Credentials are used only to call the platform they belong to, and are not shared with other third parties
Revocable Access: You can disconnect platforms and revoke access at any time

Access Controls

Authentication: Secure session management with NextAuth.js
Authorization: Every request for account data is scoped to your organization, so users only see their own organization's data
Session Security: Automatic session expiration and secure cookie handling

Application Security

Automated Checks: Every change runs through type checks, tests, dependency audits, secret scanning, and static analysis (Semgrep, CodeQL) before release
Dependency Updates: Dependency and security updates are proposed automatically and reviewed
Hardening: Input validation, a nonce-based Content Security Policy, signature checks on incoming webhooks, and rate limiting on sensitive endpoints

Privacy & Payments

Data protection and payment handling:

Data Protection: We support GDPR and CCPA data rights; see our Privacy Policy
Payment Security: We never see or store card numbers. Subscriptions are paid through Stripe (web) or Apple (App Store in-app purchase)
Transparency: Our subprocessors and Data Processing Addendum are public

Your Data Rights

You have control over your data:

Data Access: Request information about what data we have about you
Data Deletion: Delete your account and its data yourself in Settings (web or iOS), or ask support
Data Updates: Update or correct your personal information through your account settings

Security Incidents

In the event of a security incident, we are committed to:

Notifying affected customers without undue delay
Investigating and addressing the issue
Implementing necessary corrective measures
Complying with applicable breach notification laws

Best Practices for Users

Help us keep your account secure:

Use a strong, unique password for your account
Never share your account credentials
Keep your platform API keys secure and don't share them
Regularly review your connected platforms
Log out from shared or public computers
Report any suspicious activity immediately

Responsible Disclosure

We welcome security researchers and users to report security vulnerabilities responsibly:

Email: support@affiliatemanager.us (Subject: SECURITY)
Response Time: We aim to acknowledge security reports within two business days

Please do not publicly disclose vulnerabilities until we have had a chance to address them. We commit to working with you to understand and resolve the issue promptly.

Questions or Concerns?

If you have security concerns or questions about our data protection practices:

Email: support@affiliatemanager.us

For immediate security incidents, please mark your email as "URGENT - SECURITY" in the subject line.