Security

ModelTally uses layered application and provider controls to reduce risk. No system can be guaranteed secure, and this page does not claim a certification or independent audit that has not been completed.

• Supabase manages account authentication and server-validated sessions.
• Product routes load an authenticated user and organization context.
• Database tables use row-level security policies to scope customer records by user or organization.
• Administrative service credentials are created only in server-side modules and are not intended for browser bundles.

• Server actions and API routes validate authentication before protected operations.
• Provider and billing secrets are read from server environment configuration.
• Stripe webhook processing verifies signed events before updating billing state.
• Tenant data operations use organization identifiers and database access policies.

ModelTally relies on hosted infrastructure, Supabase, Stripe, Trigger.dev, Mapbox, and configured AI providers. Their systems process limited information needed to provide authentication, storage, billing, business search, background tasks, or scans.

• Use a unique password and protect access to the associated email account.
• Sign out on shared devices and remove access for people who no longer need it.
• Avoid placing secrets or sensitive personal data in tracked questions.
• Report suspicious activity promptly.

Email [email protected] with a clear description, affected URL, reproduction steps, and potential impact. Do not access other users' data, disrupt service, or disclose a suspected vulnerability publicly before we have had a reasonable opportunity to investigate.