No badges. Receipts.

The boundary between two customers is tested, not asserted

Every table that holds account data sits behind Postgres row-level security — the database itself refuses a row that belongs to another organization, before any application code runs. Policies like that are easy to claim and easy to quietly break, so they are not the claim. The claim is the test.

A script signs in as two real tenants — two organizations, two real signed-in sessions, the same requests a browser would make — against the live database, and asserts that neither session can read a single row of the other’s, or write anything at all. It derives its table list from the database migrations themselves, so a new table is covered by existing, not by someone remembering to add it. The latest run, on 2026-09-05, covered 19 tables: no cross-reads, and no writes of any kind.

It is a test that can fail. Loosening any one policy to allow everyone turns it red — that mutation is part of how the test itself is checked. A green light that cannot go red is decoration, and this one is not decoration.

The honest limit: that is the database layer. The API layer in front of it has the same rules but its cross-tenant test cannot complete until paid accounts exist to test with — a gap we track rather than paper over.

What we hold about you is a list you can read

A signed-in account can ask the API what this product holds about it — GET /v1/rights/manifest — and the answer is per table: whether each holding is included in an export, retained through an erasure and why, or not held at all. The list is generated from the same inventory the export and erase endpoints run on, and a database table missing from it fails our build rather than silently vanishing from the answer.

Beside it: /v1/rights/export hands an admin a copy of everything the account holds, and /v1/rights/erase lets an owner destroy the account. Both are buttons in the app, not a support ticket. What each counter on the website records is on the privacy page.

No model training on customer data — including when it pays

A scan record holds a brand, its competitors, and where it is losing. We treat that the way an accountant treats client financials: it never appears in a public page, a case study or an aggregate statistic without an explicit, separate opt-in — never one bundled into terms of use.

And no AI model is trained on it. That sentence has a price attached, which is what makes it worth something: OpenAI offered this account 250,000 free tokens a day in exchange for permission to train on its API traffic. Declined, 2026-09-02, with the data-sharing toggle off — recorded as a standing decision, not revisited when the bill arrives.

Where things run, and what never touches them

• Card numbers never reach us. Payments go through Paddle as merchant of record, so what a card pays with lives with the payment provider, not on any machine of ours.
• The API runs on a single server in Manassas, Virginia, US, behind Cloudflare, with a firewall that admits Cloudflare’s addresses only. Account data lives in hosted Postgres (Supabase) under the row-level security described above.
• The API says out loud what it can and cannot do. Its health endpoint reports engine, store, auth and billing state publicly — the same feed the status page reads. An unconfigured engine reports as unconfigured, never as fine.

What we do not have

There is no SOC 2 report to show you. No ISO 27001 certificate, no HIPAA agreement to sign, no penetration-test attestation. Getting those is an annual audit spend that a product this size has not made, and claiming one without the audit would be worse than the gap. If your procurement process requires them, we are the wrong vendor today and would rather say so here than after a questionnaire.

What we have instead is written above, and every piece of it is the kind of thing an audit would actually ask for: a test that exercises the real boundary, an inventory that cannot drift from the schema, and decisions with dates on them.

Found something?

If you believe you have found a vulnerability, write to hello@answermend.com with enough detail to reproduce it. It lands with the person who wrote the code, and a real report gets a real reply. There is no bounty program yet; there is credit, gratitude, and a fix.