Security posture

Preludeum is a hosted SaaS application for searching supported public sources, reviewing ranked results, preparing reviewed drafts, and opening the original source platform. Security depends on the deployed application, hosting and database configuration, provider settings, customer account configuration, and customer use. No online service can guarantee that unauthorized access is impossible.

Authentication uses Supabase sessions. OAuth state and PKCE values are kept in short-lived HTTP-only cookies where supported. A separate access gate can be enabled for controlled deployments, but it does not replace authentication, authorization, tenant isolation, or least-privilege administration.

Server-side authentication and project-ownership checks protect workspace routes. Row-level security is enabled on tenant tables, direct browser-role table access is revoked, and service RPCs are restricted to the server-side service role. Authorization checks cover campaigns, leads, raw source data, reply drafts, billing, exports, analytics, and account settings.

Provider keys, OAuth client secrets, service-role keys, database URLs, and AI keys remain server-side. Connected posting is currently unavailable. Any retained legacy provider tokens remain encrypted at rest, are never returned to browser code, and are removed locally when the connection is deleted.

The application stores convenience data in browser storage, including active-campaign selection, user-bound campaign or dashboard caches, analytics caches, sync cooldowns, and theme/sidebar preferences. Reply drafts are stored server-side. Browser storage can still contain limited personal or customer data. Do not use it for secrets, OAuth tokens, passwords, or highly sensitive content.

Public-source posts, author handles, URLs, scores, feedback, locations, and reply drafts can be personal data. Raw provider metadata and export routes are limited to the authorized workspace. Source content remains subject to the rights, terms, and deletion rules of the original platform. Preludeum does not promise universal source-deletion reconciliation.

AI prompts and provider responses can contain campaign instructions and public post text. Preludeum does not intentionally place OAuth tokens, full prompt bodies, raw provider payloads, or private notes in production logs. Access to debugging logs, billing records, and security events is restricted and retained only as needed for security and service operation. Active provider terms and account configuration govern AI retention and abuse monitoring.

Stripe hosts payment collection and payment-method management. Billing webhooks are signature-verified and processed idempotently before subscription access is changed. Full card numbers and card security codes are not stored by Preludeum. Payment-provider access and webhook secrets are restricted to the server-side billing integration.

The app sets security-oriented response headers including X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Strict-Transport-Security, Content-Security-Policy, and route-specific X-Robots-Tag behavior. Production deployment uses HTTPS and protected environment variables. Dependencies and operational controls are reviewed as the service changes.

Security issues can be sent to support@preludeum.com. Please include the affected URL, reproduction steps, expected impact, and whether any data may have been exposed. Do not include tokens or credentials in a report. Reports are triaged according to their severity and the operator's incident-response process; no fixed response time is promised.