We are a young company. We do not hold SOC 2 or ISO 27001 certification. This page describes our actual practices, not a compliance claim.
1. What we collect, and what we deliberately do not
We store account details (email, name, optional business profile), the domains you audit, audit results, and billing status. We fetch only publicly reachable pages of the domains you submit.
We do not store card numbers (the payment processor handles them), we do not log in to your site, and we do not collect data about your human visitors. Full detail is in the Privacy Policy.
2. Data in transit and at rest
- In transit: the site and its backend are served only over HTTPS (TLS). Our audit requests to your site use HTTPS where your site supports it.
- Where data is stored: US East (Lovable Cloud / AWS / Cloudflare)
- Encryption at rest: AES-256 standard encryption for stored databases and backups
- Passwords: never stored in plain text; they are hashed by our authentication provider.
- Backups: Daily automated database backups retained for 7 days
3. Access control
- Each customer's projects and audits are separated by database row-level rules tied to their signed-in account; one customer cannot read another's data through the app.
- Administrative actions (for example updating the status page) require an admin role stored separately from user profiles and checked on the server.
- Who inside the company can access customer data: Only accounts holding the admin role can use admin screens, checked on the server; named staff and access logging: Not yet documented
- Shared reports are opt-in, use unguessable links, can be revoked, and omit generated fixes and raw data.
4. AI agent visit data
This is our most privacy-sensitive feature, so these limits are repeated exactly from the docs:
- Pasted logs: if a line's user agent names one of the AI agents we check, we save three things: the agent's name, the page path (without anything after a "?"), and the time. IP addresses, referrers, query strings and every line from ordinary visitors are thrown away and never stored.
- The snippet only does anything when a request's user agent matches a known AI agent. Requests from people are ignored completely.
- For those requests it sends us: the user-agent string (so we can name the agent), the page path, and your project key.
- We store only the agent's name, the path without query string, and the time we received it. We do not store the full user-agent string.
- It never sends or stores IP addresses, cookies, query strings, form data, or anything about human visitors. It sets no cookies.
5. Subprocessors
| Category | Purpose | Provider |
|---|---|---|
| Hosting | Runs the website and audit engine | Lovable (Lovable Cloud) |
| Database | Stores accounts, projects and audit results | Lovable Cloud |
| Email delivery | Sends confirmations, alerts and replies | Lovable Cloud email (sender domain notify.ai-primed.com) |
| Payments | Processes subscriptions and card payments | Stripe |
| Error monitoring | Records application errors so we can fix them | None — errors are recorded in our own database, with web addresses, emails and quoted text stripped first |
| Analytics | Measures aggregate site usage | No new processor — consent-based anonymous product events and consent proof stay in our existing Lovable Cloud database |
Our infrastructure is provided by Lovable Cloud; see Lovable's trust documentation and our Trust center.
See also who we share data with and international transfers in the Privacy Policy.
6. Responsible disclosure
Email info@ai-primed.com with the subject line "[Security]" and steps to reproduce. Please don't access other customers' data, degrade the service, or run automated scanning against production.
What we commit to: acknowledge your report within 3 business days; keep you updated while we investigate; fix confirmed issues as quickly as their severity warrants; credit you if you'd like; and not pursue legal action against good-faith research that follows these rules.
We do not currently run a paid bug bounty and have not commissioned an independent penetration test.
7. Security changelog
- 2026-10-09 — Published this security page and a manually updated service status page.
- 2026-10 — All outbound audit requests pass a shared guard that refuses private, local and cloud-metadata addresses, re-checks every redirect hop, and returns no internal detail in errors.
- 2026-10 — Contact form added with a spam honeypot and per-network sending limits; network addresses are stored only as one-way hashes.