Security

Infrastructure

hosted on managed cloud infrastructure (Lovable Cloud / Supabase on AWS, Cloudflare edge) in the United States with automated backups, DDoS protection and WAF.

Encryption

TLS 1.2+ for all traffic; data encrypted at rest; platform access tokens and API keys encrypted with a separate application key; secrets never exposed to the browser.

Access control

organization-level isolation enforced in the database (row-level security) and in every server function; role-based permissions (owner, admin, member, viewer); optional two-factor authentication; session management with sign-out-everywhere.

Platform tokens

least-privilege scopes, per-organization storage, automatic health checks and expiry alerts, immediate revocation on disconnect.

Application security

dependency scanning, code review, rate limiting, bot protection (Turnstile), audit log of sensitive actions, signed webhooks.

Payments

processed by Stripe (PCI DSS Level 1); card numbers never touch our servers.

AI providers

data sent to model providers under contracts that prohibit training on it where available; no customer data used for AdEagle model training without opt-in.

Availability

status page at status.adeagle.io [placeholder]; incident response with customer notification within 72 hours of a confirmed personal-data breach.

Responsible disclosure

report vulnerabilities to security@adeagle.io or support@adeagle.io. We acknowledge within 2 business days and do not pursue good-faith researchers.