Your Idea Is Safe With Us

We build on enterprise-grade infrastructure from industry-leading providers:

• Authentication: Supabase Auth (SOC 2 Type II) with passwordless magic-link / OTP sign-in only. We never set, store, hash, or transmit passwords because we never collect them. Session tokens are JWTs validated server-side on every authenticated API request.
• Database: Supabase Postgres (SOC 2 Type II) hosted in the EU (eu-west-1, Ireland). Row-level security ensures users can only access their own data, enforced at the database level.
• Hosting: Vercel (SOC 2 Type II). Edge network with automatic HTTPS, DDoS protection, and a CORS allowlist hardcoded to our production domains.
• Payments: Stripe (PCI DSS Level 1) for new purchases. Legacy DodoPayments purchases remain on their original processor; records from our former processor Paddle are retained for accounting only. We never see or store card details.
• AI Providers: Your idea is processed through enterprise APIs from Google (Gemini), Anthropic (Claude), OpenAI (GPT), and xAI (Grok). These providers do not use your data to train their models under their enterprise API terms. Requests may be routed through managed model platforms and gateways such as Amazon Bedrock and OpenRouter, each with its own data handling policies.
• Market Research: Market and competitive research uses third-party data providers. They never receive your idea or any personal data, only broad market and category terms.
• Abuse Defenses: Server-side rate limiting on every public endpoint, with stricter limits on authentication endpoints. IP-based abuse detection auto-blocks after repeated alerts and is IPv6-aware to prevent rotation evasion. Disposable-email signups are blocked at the source.
• Input & Output: Prompt-injection detection and input sanitization run on every report submission. Server-side paywall enforcement strips locked sections from API responses; locked content never leaves our server. Audit log wraps every API handler.

Zero humans. Your idea never crosses a human inbox, dashboard, or screen. AI researches it, generates your report, that is it. The one exception is yours to choose: buy the $499 Investor Package and you are hiring the founder to personally build your pitch deck and memo from your report. Outside that, nothing you submit is ever seen by a person.

Your idea is:

• Never shared with other users or sold to anyone
• Processed by AI providers (Google, Anthropic, OpenAI, xAI) strictly to generate your report. These providers do not train on your data under their enterprise API terms
• May be routed through managed model platforms and gateways such as Amazon Bedrock and OpenRouter, each with its own data handling policies
• Stored encrypted in your private account
• Aggregate statistics (score distributions, risk rates) may appear in public research reports. Never individual ideas, names, or identifying details

Bottom line: your idea is yours. You can delete it, and everything tied to it, in one click, whenever you want.

• In transit: All data encrypted with TLS 1.3 (256-bit)
• At rest: Database encrypted with AES-256
• Isolation: Row-level security. Your data is logically separated from other users
• No plaintext secrets: Sensitive data is never stored unencrypted

You own your data. You can:

• View: Access all your reports in your account
• Delete: Remove individual reports or your entire account
• Export: Download your analysis data

When you delete data, it is permanently removed from our systems.

We take security reports seriously. If you have found a vulnerability in Preuve, email security@preuve.ai.

• We respond within 24 hours on weekdays.
• Please do not publicly disclose the issue until we have had a reasonable chance to fix it.
• Avoid actions that would degrade service for other users (no DoS, no scraping, no testing on accounts that are not yours).
• No bounty program yet, but we publicly credit responsible reporters once a fix is shipped, if you want the credit.