How we protect your organization's data

Sign-in is Clerk. The live Clerk instance allows email and password, an email code, Google, and a passkey. Passwords are required at sign-up, at least 15 characters, and checked against known breaches on sign-in. Clerk locks sign-in after 10 failed attempts for 60 minutes. We never see or store the password.

You can turn on two-step verification with a text-message code, with backup codes, from Account & security in the app. You can also add a passkey and sign in with it. Both are optional, and sign-in doesn't require them. Someone who signs in with Google uses whatever protections that Google account has. SAML and enterprise single sign-on are not enabled.

Clerk issues the session. The instance is in single-session mode with reverification on. This app does not show a device list or a control to revoke other sessions. Session lifetime is a Clerk dashboard setting and is not stored in this repository, so it is not stated here.

Clerk publishes a SOC 2 Type 2 report and describes support for GDPR and CCPA. Inspire Generosity has not signed a HIPAA business associate agreement with Clerk, and this product is not a HIPAA service. We have not commissioned our own penetration test.

Organizations have two Clerk roles, admin and member, and a maximum of 3 members. Membership is enforced by Clerk. A platform administrator (a flag on one Clerk user) can list every organization, join one as an admin, and delete one. Those actions are written to an audit log in the Admin Panel. Work done inside an organization after joining is ordinary member traffic and is not on that log.

The site is served by Cloudflare Workers. Cloudflare provides DDoS protection on proxied hostnames. This repository does not configure a Web Application Firewall ruleset, and we do not claim OWASP Top 10 coverage.

The Workers redirect http:// requests to https:// and send HSTS (max-age=31536000; includeSubDomains). The redirect does not apply to localhost. A zone-level "Always Use HTTPS" setting is outside this repository. The first request can still arrive over HTTP; the Worker answers that request with a redirect and does not send the page on it.

Each request runs in a Workers isolate, not a long-lived server we administer.

Organization data is in Cloudflare D1 (copywriter-db). Voice-document text is in R2 (copywriter-docs). Cloudflare's documentation says those products encrypt data at rest. This application does not add its own encryption of individual fields. A KV namespace named SESSIONS is bound and unused. This repository does not set a D1 jurisdiction, so a database region is not stated here.

Source code is in a private GitHub repository. Deploys go out through GitHub Actions on push to main, after typecheck and a production build. There is no second-person code review.

This repository does not contain a Dependabot configuration file, so we do not claim that dependency patches are opened automatically. Known vulnerable packages are upgraded in the lockfile when the upgrade is safe. Some findings stay open when the published fix would be a downgrade.

API keys are Cloudflare Worker secrets. The only key committed in the repository is the Clerk publishable key, which is meant to be public.

API routes that read customer data require a Clerk session token. The token is verified on each request. There is no separate password or session table of ours.

Customer routes take the organization from that verified session, not from an organization id in the request. Reads and updates for that organization's rows include that id. The platform-admin list is the exception: it loads every organization, and that request is written to the admin audit log.

Paid features are checked on the server from the organization's plan, which is updated by the Clerk Billing webhook. Hiding a control in the interface is not the only check.

JSON request bodies are checked with Zod before use. A body that does not match is rejected. Not every query string goes through a schema; the history limit is clamped to 200.

The Clerk Billing webhook is verified with a Svix signature before the body is trusted. There is no separate Stripe webhook in this application. Card charges go through Clerk Billing and Stripe.

Platform-administrator status is read from Clerk on each admin request. It is not taken from a claim in the session token.

There is no application-level rate limit on generation or other API routes. A personalized batch accepts at most 100 rows. Clerk's own sign-in lockout is described above.

Workers observability is on, and the application logs errors. It does not log a full audit trail of customer actions. The admin audit log records joins, organization-list and member-list views, deletes, and global model changes.

What happens to data on cancellation and deletion is in Privacy Policy §5. Vendors and what they receive are on the vendor page.

If we confirm a security breach that affects a customer's data, we notify affected customers without undue delay, and within 72 hours of that confirmation.

Full-organization deletion and data export are requested by email to info@inspiregenerosity.today. We complete that deletion or export within 30 days of a verified request. Deleted data may persist in Cloudflare's D1 point-in-time recovery history for its retention window before it ages out. This repository does not record that window.

Card numbers are entered in Stripe's payment form through Clerk Billing. They are not sent to our Worker. Stripe states that it is a PCI DSS Level 1 service provider. We store subscription status on the organization, and Clerk's billing events can include Stripe customer and subscription ids.

No SSO, and no customer-facing audit log.

No SOC 2 or ISO 27001 report of our own, no penetration test, no published uptime SLA, and no status page.

No application-level API rate limit. No written incident-response plan is published.

No data processing agreement is published.

DMARC for the domain is outside this repository. These pages do not claim a quarantine or reject policy.