Security & Trust

The Authority Score™ is built on a managed, security-hardened platform and operated with least-privilege access controls. This page describes the technical and organizational measures we maintain to protect customer and prospect data, and the posture we present to investors, partners, and auditors.

• In transit: All network traffic is encrypted with TLS 1.2+ across every connection.
• At rest: The managed database and file storage encrypt data at rest using platform-managed keys.
• Credentials: API keys, OAuth tokens, and payment secrets are stored in a managed secrets vault — never hardcoded or logged.

• Role-based access: Two roles — admin and user. Sensitive records (leads, payouts, email logs, prospect evidence) are restricted to admins.
• Row-Level Security (RLS): Every entity enforces data isolation. Members see only their own tasks, results, and credentials; partners see only their own referrals and commissions.
• Authentication: Managed auth provider with secure session tokens, email verification, and optional Google single sign-on.
• Admin least-privilege: Admin write access is scoped per entity and reviewed regularly.

The application runs on a managed platform (Base44) that owns infrastructure controls including encryption, database security, availability, and patching. Customer data is logically isolated per tenant through row-level security policies enforced at the data layer — no shared record access between accounts.

Material system actions are persisted to immutable log entities for review and reconciliation:

• EmailLog — every outgoing email, with delivery status and provider message ID.
• ACEDecisionLog — every autonomous sales-engine decision and its reasoning.
• ACEOutboundAction — every outbound send with idempotency keys to prevent duplicates.
• PilotIssue — deviations from acceptance gates, with root-cause and retest history.
• Payout ledger — every commission, calculated on net received, with Net-30 hold tracking.

An admin-only Audit Log dashboard surfaces these records for review.

• Members can request full account deletion at any time from the in-app Account page.
• Email recipients can unsubscribe via the CAN-SPAM-compliant opt-out link in every message.
• Commission records are retained for the duration required for financial reporting and audit.

• SOC 2: We are preparing for a SOC 2 Type II audit. Infrastructure controls are inherited from our managed platform; organizational controls (policies, access reviews, incident response) are maintained by The Authority Score™.
• GDPR: We process personal data on the legal bases of consent, contract, and legitimate interest. Data subject rights (access, rectification, erasure, portability) are honored on request.
• CAN-SPAM: All commercial email includes a physical address and a single-click unsubscribe mechanism. Opt-outs are enforced across all sequences within one business day.

We rely on the following third-party providers to deliver the service:

We operate a documented incident response process. If you believe you have discovered a security vulnerability, please report it responsibly through our contact page with the subject line "Security Report." We acknowledge reports within one business day and coordinate disclosure.