Security
How We Protect Your Data
and Our Systems
ThriveFinity processes sensitive business intelligence. Here's a transparent account of how we secure it.
Security Posture
Encrypted in Transit & at Rest
All traffic is TLS 1.2+ enforced by Cloudflare and Vercel. Secrets are SOPS-encrypted; no plaintext credentials exist in the codebase or CI environment.
Authentication via Clerk
Account access uses Clerk-managed RS256 JWTs. We do not implement custom auth logic. Session tokens are short-lived. No passwords are stored by ThriveFinity.
OWASP Top 10 Reviewed
Our codebase is assessed against OWASP Top 10 categories. All parameterised database queries, timing-safe key comparisons, and a strict Content Security Policy are in place.
Access Controls
Report downloads are owner-verified server-side (Clerk JWT, not URL parameters). Admin API endpoints are HMAC-gated. No IDOR vulnerabilities have been identified in our account routes.
Zero Known Vulnerabilities
npm audit returns 0 vulnerabilities. Python dependencies are audited in CI. The git history has been scrubbed of any historically-exposed secrets via git-filter-repo.
Backups & Monitoring
Daily automated backups to Cloudflare R2 with verified restore drills. Runtime exceptions monitored via Sentry/GlitchTip. Form health checked every 6 hours via GitHub Actions.
Data Handling
What we collect: intake form submissions (your business idea, pitch claims, company URL), email address, payment information (processed by Razorpay — we never see card details), and report interaction data.
How we use it: solely to produce your report and communicate results. We do not sell, share, or use your data for marketing to third parties.
PII handling: Free-text submissions are passed through a PII redaction layer (Presidio) before being processed by language models. Identifiable details in your intake are not used to train any model.
Retention: Report data is retained for 90 days by default (see our privacy policy) and purged earlier on request. Triage and magic-link tokens are purged automatically past their grace period by our retention purge script.
Subprocessors: Vercel (hosting), Cloudflare (CDN/tunnel), Hetzner (compute), Clerk (auth), Razorpay (payments), Resend (transactional email), OpenRouter (LLM routing), Langfuse (LLM observability — no raw PII stored), Sentry/GlitchTip (error monitoring).
Full details in our Privacy Policy and Trust Centre.
Responsible Disclosure
If you discover a security vulnerability in our systems, we ask that you disclose it to us privately before making it public. We commit to:
- Acknowledging your report within 48 hours
- Providing a resolution timeline within 7 days
- Crediting you (by name or pseudonym, your choice) in our errata log once the issue is resolved
- Not pursuing legal action against researchers acting in good faith
To report: Email om@thrivefinity.uk with subject line [Security]. Include a clear description of the vulnerability and steps to reproduce.
Scope: www.thrivefinity.uk, api.thrivefinity.uk, and any subdomain serving ThriveFinity content. Out of scope: third-party services (Razorpay, Clerk, Vercel), social engineering, physical attacks, and denial-of-service testing.
Security Audit History
| Date | Item | Status |
|---|---|---|
| 2026-07-16 | OWASP Top 10 internal assessment — no critical findings | Resolved |
| 2026-07-16 | IDOR assessment of /account/* routes — no vulnerability | No finding |
| 2026-07-16 | Fail-closed gates on /leads, /leads/data, /sla API routes | Fixed |
| 2026-07-15 | AUTO_TRIAGE disabled by default (env var not set in production) | Confirmed off |
| 2026-07-10 | --danger token re-tokenised — AAA contrast on both themes | Fixed |
| 2026-07-06 | Resend API key rotated after exposure; confirmed zero errors since | Fixed |
| 2026-07-06 | Vercel PAT revoked after exposure in prior session | Revoked |
| 2026-07-03 | Plaintext secrets scrubbed from full git history via git-filter-repo | Resolved |
| Open | SSRF IP blocklist in First Signal fetch handler (low risk, Hetzner not AWS) | Monitoring |
| Open | Tailscale ACL: allow Hetzner → NTFY alert IP | Monitoring |
Security Contact
Questions or Concerns?
For security reports, data requests, or questions about our practices, email directly:
om@thrivefinity.uk →