--- title: "Security - Preuve AI" slug: security description: "How Preuve AI protects your startup idea. Enterprise-grade encryption, SOC 2 infrastructure, and full data control." canonical: https://preuve.ai/security date_published: 2026-02-02 date_modified: 2026-08-20 last_updated: August 20, 2026 --- # Security at Preuve AI > **TL;DR:** Preuve AI protects your startup idea with passwordless magic-link authentication, TLS 1.3 in transit, AES-256 at rest, Cloudflare D1 and R2 storage (SOC 2 Type II) with every query scoped server-side to your account, Vercel and Cloudflare hosting (both SOC 2 Type II), Stripe payments (PCI DSS Level 1), enterprise AI APIs from Google, Anthropic, OpenAI, and xAI that do not train on your data, GDPR Article 33 breach notification within 72 hours, and a delete-anytime endpoint that purges your data on request, with no human seeing your idea unless you hire the founder for the $499 Investor Package. Last updated: August 20, 2026. ## The short version Your idea is encrypted, isolated, and processed only by AI. The only time a person is ever involved is a deck you hire the founder to build from your report, your call. Otherwise no human ever reads what you submit. Preuve AI is a validation tool, not a competitor. You can delete your data anytime. ## Trust badges - **Passwordless**: Magic-link / OTP only. No passwords to leak. - **Encrypted**: TLS 1.3 in transit, AES-256 at rest. - **SOC 2 Infrastructure**: Cloudflare + Vercel, both SOC 2 Type II. - **You control your data**: Delete anytime from your account. ## Infrastructure security - **Authentication**: Self-hosted passwordless magic-link and OTP sign-in, running on Preuve AI's own Cloudflare Workers API. Preuve AI never sets, stores, hashes, or transmits passwords because it never collects them. Every authenticated request is resolved to a session server-side; a client-supplied user id is never trusted. - **Database**: Cloudflare D1, with Cloudflare R2 for generated files, on Cloudflare infrastructure (SOC 2 Type II) with primary storage in the United States. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, and its Data Processing Addendum incorporating the EU Standard Contractual Clauses applies. Every query is scoped server-side to the authenticated account, so users can only reach their own data. - **Hosting**: Website on Vercel (SOC 2 Type II), application API on Cloudflare Workers (SOC 2 Type II). Edge network with automatic HTTPS, DDoS protection, and a CORS allowlist hardcoded to production domains. - **Payments**: Stripe (PCI DSS Level 1) for new purchases. Legacy DodoPayments purchases remain on their original processor; records from the former processor Paddle are retained for accounting only. Preuve AI never sees or stores card details. - **AI providers**: Your idea is processed through enterprise APIs from Google (Gemini), Anthropic (Claude), OpenAI (GPT), and xAI (Grok). These providers do not use your data to train their models under their enterprise API terms. Requests may be routed through managed model platforms and gateways such as Amazon Bedrock and OpenRouter, each with its own data handling policies. - **Market research**: Market and competitive research uses third-party data providers. They never receive your idea or any personal data, only broad market and category terms. - **Abuse defenses**: Server-side rate limiting on every public endpoint, with stricter limits on authentication endpoints. IP-based abuse detection auto-blocks after repeated alerts and is IPv6-aware to prevent rotation evasion. Disposable-email signups are blocked at the source. - **Input and output**: Prompt-injection detection and input sanitization run on every report submission. Server-side paywall enforcement strips locked sections from API responses; locked content never leaves the server. An audit log wraps every API handler. ## Who sees your idea Zero humans. Your idea never crosses a human inbox, dashboard, or screen. AI processes it, generates your report, and that is it. The one exception is yours to choose: buy the $499 Investor Package and you are hiring the founder to personally build your pitch deck and memo from your report. Outside that, nothing you submit is ever seen by a person. Your idea is: - Never shared with other users or sold to anyone - Processed by AI providers (Google, Anthropic, OpenAI, xAI) strictly to generate your report. These providers do not train on your data under their enterprise API terms - May be routed through managed model platforms and gateways such as Amazon Bedrock and OpenRouter, each with its own data handling policies - Stored encrypted in your private account - Aggregate statistics (score distributions, risk rates) may appear in public research reports. Never individual ideas, names, or identifying details Bottom line: your idea is yours. You can delete it, and everything tied to it, in one click, whenever you want. ## Data encryption - **In transit**: All data encrypted with TLS 1.3 (256-bit) - **At rest**: Database encrypted with AES-256 - **Isolation**: Every query is scoped server-side to your authenticated account, so your data is logically separated from other users - **No plaintext secrets**: Sensitive data is never stored unencrypted ## Your control You own your data. You can: - **View**: Access all your reports in your account - **Delete**: Remove individual reports or your entire account - **Export**: Download your analysis data When you delete data, it is permanently removed from the systems. ## Common questions ### Will you steal my idea? No. Preuve AI has analyzed 8,000+ ideas to date, from weekend projects to VC-backed startups. If the team stole ideas, they would have been exposed by now. Preuve AI is a validation tool, not a venture studio. From Vincent, founder: your idea is private. A solo founder who can barely keep up with his own product does not have time to steal yours. ### Can your employees see my idea? No. Preuve AI is a solo company with no employees, and your idea is processed entirely by AI. The one exception is opt-in: buy the $499 Investor Package and you are hiring the founder to build your deck and memo from your report. Access to production data requires multi-factor authentication and is logged for security audits. ### Is my idea used to train AI? The AI providers (Google, Anthropic, OpenAI, xAI) operate under enterprise API terms that prohibit using your data for model training. Requests may be routed through managed model platforms and gateways such as Amazon Bedrock and OpenRouter, each with its own data handling policies. ### How is my data protected if something goes wrong? Cloudflare and Vercel both run formal incident response programs. Per GDPR Article 33, affected users are notified within 72 hours of confirming a breach that affects their data. The delete-account endpoint immediately purges your data from the database and the auth tables on request, and refund-related data revocation is handled the same way. ### Why no password? Passwords are the most-attacked surface in any web app. By using one-time codes and magic links instead, Preuve AI removes credential stuffing, password-reuse exposure, brute force, and password-leak risk in one move. You sign in by clicking a link sent to your verified email. That is the entire mechanism. ## Responsible disclosure Found a vulnerability? Email security@preuve.ai. - Preuve AI aims to respond within 2 business days. - Please do not publicly disclose the issue until the team has had a reasonable chance to fix it. - Avoid actions that would degrade service for other users (no DoS, no scraping, no testing on accounts that are not yours). - No bounty program yet, but Preuve AI publicly credits responsible reporters once a fix is shipped, if you want the credit. ## Contact - Security reports: security@preuve.ai - General questions: hello@preuve.ai ## Canonical - HTML: https://preuve.ai/security - Markdown: https://preuve.ai/security.md - Is Preuve AI legit (founder answer): https://preuve.ai/blog/is-preuve-ai-legit - Date published: 2026-02-02 - Date modified: 2026-08-20