Security & Trust
Last updated: September 20, 2026
At McLeuker AI, security is foundational to everything we build. We are committed to protecting your data and maintaining your trust through industry-standard security practices and transparent operations.
This page is a summary. Our full security overview — including the controls we have implemented and the gaps we have not yet closed — is maintained alongside our source code and is available to enterprise customers and their security reviewers on request from security@mcleuker.com.
Assurance Status
We maintain a documented security program mapped to the SOC 2 Trust Services Criteria, with fourteen security policies and a control matrix we will share under NDA. No SOC 2 examination has been performed, and no third-party penetration test has been performed. We describe our position as SOC 2 aligned, not SOC 2 certified — certification is not something SOC 2 produces for any vendor.
Two-factor authentication is available. What we do not yet offer: the ability to require it across everyone in your account, single sign-on, and roles and permissions within a customer account. We publish these gaps rather than wait for them to be found in your review.
Data Encryption
In Transit
All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher. We enforce HTTPS across all endpoints and use HSTS headers to prevent downgrade attacks.
At Rest
All data stored in our databases is encrypted at rest using AES-256 encryption, managed by our infrastructure providers (Supabase, Railway).
Authentication & Access Control
We use Supabase Auth with OAuth 2.0 and PKCE (Proof Key for Code Exchange) for secure authentication. User sessions are managed via secure, HTTP-only cookies. We support Google OAuth for convenient and secure sign-in. Row-Level Security (RLS) policies ensure that users can only access their own data at the database level.
You can protect your account with two-factor authentication from Settings → Security: enrol an authenticator app and you will be asked for a six-digit code each time you sign in. Deleting an account requires that code as well as the password, so a stolen password on its own cannot destroy your data.
Infrastructure Security
Our infrastructure is hosted on enterprise-grade platforms (Vercel, Railway, Supabase) which each maintain their own SOC 2 Type II attestations — those reports cover their platforms, not ours. We use environment-based secret management and never store API keys or credentials in source code. Secret values are additionally stripped from our logs and from any output returned to you, and credentials you entrust to the platform are encrypted by us before storage so that they remain unusable to anyone holding only the database contents.
AI Safety & Data Isolation
User data submitted to AI models is processed in real-time and is not used to train or fine-tune any models. Each user's conversation data is isolated at the database level through Row-Level Security policies. We do not share user data between accounts or with third parties beyond what is necessary to provide the Service.
Auditing
Every action the platform takes on your behalf is recorded in an audit trail with the operation performed, its outcome, and the user and session it belonged to. Credentials and tokens are redacted from our logs before they are written. We verify daily, against the live database, that row-level security policies remain in force on every table holding customer data.
Data Retention & Deletion
Your content is retained for as long as you keep it. When you delete a conversation it is hidden immediately and permanently purged after a 30-day recovery window — and that purge removes the record together with everything derived from it, including generated files, stored objects and derived memory.
Deleting your account is separate, self-service and irreversible: it removes every conversation and stored file, every table holding your data, rows naming you on other people's shared boards, and your sign-in identity itself. We verify that coverage automatically rather than by review — a test requires every table carrying a user identifier to be reached by the deletion path, and nothing is exempt from it.
You can also export your data from Settings → Account: a JSON file of everything we hold about you, which arrives with a machine-readable list of anything it excluded and why, so it can never be mistaken for the whole. Your security audit log is available on formal request rather than in that file, and the file says so. Requests under GDPR Articles 15–22 are answered within one month.
Incident Response
In the event of a data breach, we will notify affected users and the relevant supervisory authority (CNIL) within 72 hours, as required by GDPR Article 33. Our incident response process includes immediate containment, investigation, notification, and remediation steps.
Responsible Disclosure
If you discover a security vulnerability in our platform, please report it responsibly to security@mcleuker.com. We appreciate the security research community and will acknowledge your contribution. Please do not publicly disclose the vulnerability until we have had a reasonable opportunity to address it.
Contact
For security-related questions or concerns, please contact security@mcleuker.com.