Trust & Security

BotDoors uses email/password authentication with the option to sign in via Google. Sessions are managed by our backend provider with short-lived access tokens and refresh-token rotation. Public sign-ups are currently disabled — only pre-approved accounts can sign in.

Admin areas (/admin and sub-routes) are gated by a server-enforced role check stored in a dedicated user_roles table. Role checks never rely on values supplied by the browser.

Application data is stored in a managed Postgres database with Row-Level Security enabled on every user-facing table. Admin-only tables (support tickets, mailbox contents, AI cost audits, outreach pipelines, backlink data) are readable only by authenticated admins.

Public verdict pages expose only the columns intended to be public. Email addresses captured during a verdict request are stored on a column that is revoked from the public API and never returned to anonymous or signed-in users.

The frontend is served as static assets through Lovable's hosting. The backend (database, authentication, storage, edge functions) runs on Lovable Cloud, which is built on Supabase infrastructure. Network traffic is served over HTTPS/TLS.

This is a shared-responsibility model: the underlying platform secures the infrastructure layer, and the BotDoors team is responsible for the application's data model, access policies, and operational practices described on this page.

BotDoors is 100% free. There is no checkout, no subscription, and no payment processor. We never collect card details, billing addresses, or bank credentials because nothing on this site is ever charged for.

BotDoors uses first-party storage for authentication sessions and lightweight usage analytics to understand which features are used and to detect abuse. We do not sell personal data to third parties.

Account data is retained while your account is active. To request export or deletion of data associated with your account or email address, contact us using the channel below. We will respond within a reasonable timeframe and confirm once the request has been actioned.

If you believe you have found a security issue, please report it through our support channel with as much detail as possible (steps to reproduce, impact, affected URL). Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and remediate.

We do not currently offer a paid bug-bounty program. We do appreciate responsible disclosure and will credit reporters on request.

BotDoors is not currently certified under SOC 2, ISO 27001, HIPAA, or similar frameworks, and we do not claim compliance with those standards. PCI-DSS is not applicable: the platform is free and processes no cardholder data at all.

If your organization needs specific contractual terms (DPA, sub-processor list, security questionnaire), reach out via /contact and we will respond with what we can provide today.