Security at SourceGent

SourceGent runs on enterprise-grade cloud infrastructure hosted in SOC 2 Type II certified data centers, with DDoS mitigation and web application firewall protection at the edge. All traffic is encrypted in transit with TLS 1.3, and all data is encrypted at rest with AES-256. Databases are backed up daily with point-in-time recovery. Uploaded files are never publicly accessible: they are served only through short-lived signed URLs to authorized users.

Every piece of data in SourceGent is scoped to the authenticated user and their company. We enforce this at the database level using row-level security (RLS), not just in application code.

What This Means

• Your proposals, documents, and company profile are never visible to other users
• Multi-company accounts enforce company-level isolation: Company A cannot access Company B data
• Team members only see data scoped to the companies they have been explicitly invited to
• RLS policies are enforced at the database query layer, providing defense-in-depth even if application code has a bug

Proposal Sharing

The optional review portal uses cryptographically random share tokens. Shared links expire automatically and are protected against brute-force enumeration. You can revoke any share link at any time from your account settings.

• Passwords are protected with industry-standard hashing: we never store plaintext passwords
• Email verification is required before accessing AI features
• Sessions use secure, HTTP-only cookies with short-lived credentials
• All authenticated routes are protected server-side; client-side guards are defense-in-depth only
• Team invitations expire and are single-use; they cannot be redeemed by unintended recipients
• Account deletion removes all associated data

We use Anthropic's Claude API to analyze documents and generate proposal content. We take the following measures when handling AI processing:

Data in Transit to Anthropic

• All API calls to Anthropic are made over HTTPS/TLS
• We operate under Anthropic's commercial API terms, which prohibit training on API inputs without explicit opt-in
• Your document content is never shared with other SourceGent users or organizations
• We do not use your proposals or documents to fine-tune or train any AI model

AI Usage Controls

• Per-endpoint rate limiting and daily cost caps protect against abuse
• Usage budgets fail closed: if usage cannot be verified, AI requests are denied rather than allowed to run uncapped
• Every AI call is logged for quota tracking and anomaly detection
• Feature access checks fail closed: an error during an access check denies access, never grants it

Input Validation & File Handling

• Uploaded files are validated by their content, not just their filename or extension
• Files are stored in isolated storage buckets, never served from the web root
• All user-supplied input is validated and sanitized server-side

Request Security

• Content Security Policy (CSP) headers on all responses
• Cross-origin access is restricted to authorized domains only
• Internal and scheduled endpoints require authentication; nothing is open by default

Auditing & Administrative Access

• Sensitive actions are recorded in an audit log
• Administrative access is strictly limited and enforced server-side

Concurrent Editing Protection

If two users (or two tabs) attempt to save the same proposal section simultaneously, the conflict is detected and the second write is rejected with a warning rather than silently overwriting work.

• All payments are processed by Stripe, a PCI DSS Level 1 certified payment processor
• We never store, transmit, or log raw credit card numbers or CVV codes
• Every payment event is cryptographically verified and matched to your account before any subscription change is applied
• Subscription state is independently reconciled on a regular schedule, so billing status stays accurate even if an individual event is missed

• Error monitoring: Application exceptions are captured and triaged in real time
• Performance monitoring: Latency and error rates are tracked continuously
• Dependency updates: We monitor and apply security patches to our dependency tree on a regular basis

In the event of a data breach that affects your personal information, we will notify affected users in accordance with applicable laws, including providing details about what was affected and steps taken to address the issue.

We welcome security researchers and users to report potential vulnerabilities. If you believe you have found a security issue in SourceGent, please report it to us before disclosing it publicly.

We do not currently offer a bug bounty program, but we do acknowledge responsible disclosures and take every report seriously.

Have security questions that aren't answered here? Contact us: