Security
Last updated October 13, 2026
Term Detective keeps sourced profiles of what AI and SaaS vendors' public documents say about customer data. Most of what we hold is public information. The personal data we hold is small, and this page lists all of it.
What we store
Public vendor documents and the answers drawn from them. Copies of vendors' public terms, privacy policies, DPAs and subprocessor lists, with the dated answers and quotes we extract. This is public information.
Account data. Your email address, your plan, the vendors you watch, your alert preferences, and the email addresses of teammates you invite (Team plan).
Sign-in data. We use email sign-in links instead of passwords, so there are no passwords to steal. Links work once and expire after 15 minutes. We store only a one-way hash of each link and of each session token, so reading our database cannot be used to sign in. Sessions last 30 days and use secure, HttpOnly cookies.
Billing. Payments are handled by Stripe. We store your Stripe customer ID and plan. We never see or store card numbers.
Messages you send us. Contact form messages (name, email, message), vendor requests, and, if you join the waitlist, your email address and a record of your consent.
Email delivery records. The recipient, type of email and time sent, so we can send at most one alert email a day and diagnose failures.
What we do not store. Passwords, card numbers, or any content from your own vendor accounts. We never ask for access to your systems or your vendor accounts.
Visitor IP addresses. Our application does not record them in its database. Cloudflare, which serves the site, processes them to deliver and protect it.
Encryption
Data is encrypted in transit: the site is served over HTTPS only, and browsers are told to use HTTPS (HSTS). Data is encrypted at rest: our database (Cloudflare D1) and file storage (Cloudflare R2) encrypt stored data with AES-256, as described in Cloudflare's documentation. Encryption keys are managed by Cloudflare.
Backups and recovery
Our database supports point-in-time restore to any moment in the last 30 days, and the page text we store is kept in encrypted storage. We do not keep scheduled exports outside Cloudflare today.
How we protect the site
- Browser protections. Every page is sent with a strict Content-Security-Policy, HSTS, and related headers, so that injected scripts do not run and the site cannot be framed by other sites.
- Restricted admin area. Our administration pages sit behind Cloudflare Access and are not reachable by the public. Sign-in to the admin area requires multi-factor authentication.
- Verified payments. Payment events from Stripe are accepted only if their cryptographic signature checks out.
- Careful releases. Every release is type-checked and tested automatically, is followed by a live check of the site, and rolls back automatically if that check fails.
- Dependency monitoring. We monitor our software dependencies for known vulnerabilities and update or assess each one that is reported.
- Spam and abuse limits. Sign-in and sign-up requests are rate limited.
How we use AI
We use AI models to read the text of vendors' public documents and propose answers, which we review before they are published. Our systems do not send customer account data, such as email addresses, plans, or the vendors you watch, to AI models.
Subprocessors
These companies process data on our behalf. The same list appears in our Privacy Policy, and we will notify account holders by email at least 14 days before engaging a new subprocessor. Certifications are as each company states them in its own public documents; we have not verified them.
| Company | What it does for us | Certifications it states |
|---|---|---|
| Cloudflare | Hosting, database, file storage, DNS, website analytics, and receipt of vendor notice emails | SOC 2 and ISO 27001 (Cloudflare D1 data security) |
| Stripe | Payment processing | PCI DSS Service Provider Level 1; SOC 1 and SOC 2 Type II (Stripe security) |
| Resend | Sending sign-in links, alerts, newsletters, and waitlist email | SOC 2 Type II (Resend security) |
| Anthropic | Reading public vendor documents (no customer data) | SOC 2 Type I and Type II, ISO 27001:2022, ISO/IEC 42001:2023 (Anthropic) |
| Porkbun | Domain registration and forwarding of mail sent to our addresses | None stated on pages we checked |
| Microsoft Outlook | Receipt of mail sent to our addresses | ISO 27001 and SOC 2 (Microsoft compliance offerings) |
Our source code is hosted on GitHub. It contains no customer data.
Our own certifications
Term Detective does not currently hold SOC 2 or ISO 27001 certification. We rely on the controls above and on the certified infrastructure we build on.
Your data
Account owners can close their account and delete its data from the Close my account page once they are on the free plan. If you have a paid plan, cancel it first; it converts to the free plan at the end of the paid term. You can also email privacy@termdetective.com. Closing an account deletes its data; copies in backups are removed within 30 days. We keep billing records as long as tax law requires, and Stripe holds them. See our Privacy Policy for the full details.
Reporting a security issue
If you think you have found a vulnerability, email security@termdetective.com. Please tell us what you found, how to reproduce it, and the pages or addresses affected. We will acknowledge your report within 5 business days and keep you updated until it is resolved. That is how fast we reply to you, not how fast we fix.
Scope. This policy covers termdetective.com and its subdomains. It does not cover third-party services we use (for example Cloudflare or Stripe), which have their own programs, or the vendor websites we read. Social engineering, physical attacks, spam, and denial-of-service or high-volume automated testing are out of scope.
Good faith. Please access only as much data as you need to show the issue, and stop there. Do not view, change, or delete other people's data, and do not disrupt the service. Give us a reasonable time to fix the issue before you make it public (we ask for 90 days). We do not run a paid bounty program.
Safe harbor. If you act in good faith and follow this policy, we will treat your research as authorized, we will not pursue or support legal action against you for it, and we will work with you to understand and fix what you found. This promise covers our systems only; we cannot speak for third parties.
Our contact details are also published in machine-readable form at /.well-known/security.txt.