Security

SkySearch keeps two things apart. One is the public marketing site. The other is the workspace you sign in to. Provider and database credentials stay in server-side functions.

Data isolation

Application tables use Supabase row-level security.

Before privileged database work can change a search, a credit, a Contact, a folder or a grid, it checks two things. Who is signed in? And who owns that workspace?

Research safety

Payloads reach us from providers, from the AI, from a CSV and from professional contacts. We treat them all as untrusted text. Three rules follow.

• we check inputs and structured outputs
• source URLs must be public HTTP or HTTPS links
• research is never rendered as HTML

Payments

You enter card details on Stripe’s own checkout page. They never reach our servers.

Reporting

Found a security problem? Write to security@skysearch.net.

This page lists the controls we have in place. It does not claim an outside certification.