TLS in transit
All traffic to ValidatePros is served over HTTPS. Requests to our backend and to third-party APIs (Stripe, AI providers) are made over TLS.
Security overview
This page is maintained by ValidatePros to answer common security and privacy questions about the product. It describes the controls we currently have in place. It is not a certification and does not claim SOC 2, ISO 27001, HIPAA, PCI, or GDPR-audited status. For legal terms see our and .
Managed authentication
Sign-in is handled by our managed auth provider with hashed credentials, session refresh, and password-reset flows. We never see or store your password in plain text.
Row-level security on user data
Projects, reports, chats, credits, and profiles enforce row-level security policies so authenticated users can only read and modify their own rows. Admin access is gated by a separate role table.
Server-only billing entitlements
Subscription tier, credit balances, and Stripe metadata can only be written by our backend service role. The client can read its own tier and remaining credits but cannot elevate them.
Verified, idempotent Stripe webhooks
Stripe events are verified with the webhook signing secret and de-duplicated through a dedicated events table with a bounded retry lease, so a replayed or repeated delivery cannot double-apply a subscription or credit change.
Endpoint and generation controls
Chat, website analysis, and comparison endpoints validate input and enforce per-user rate limits. Report generation is protected by ownership checks, atomic credit charging, a single active attempt lease with heartbeat, resumable partial progress, and idempotent finalization so a duplicate or resumed run cannot double-charge or corrupt a report.
Privacy-aware operational logging
We log operational events (failures, retries, admin actions) to help us keep the service healthy. Analytics event properties are sanitized and path segments containing UUIDs are normalized before storage. We do not log passwords, Stripe IDs, or raw AI prompts.
Responsible disclosure
If you believe you've found a vulnerability, please email security@validatepros.com with reproduction steps. Please do not test against other users' accounts or data. We do not currently run a paid bug bounty program.
Shared responsibility
ValidatePros operates on top of managed hosting and third-party providers (Stripe for payments, AI model providers for report generation). Their platform-level controls sit underneath ours. You are responsible for protecting your account credentials, keeping your recovery email current, and being thoughtful about the sensitivity of ideas you submit for analysis.
Incident response
We investigate security reports as they come in and use our operational event log to detect service failures. If we identify an incident that materially affects your data, we will notify you as appropriate and as required by applicable law, with a description of what happened, what data was affected, and what steps we took.
Report a security issue: security@validatepros.com
This overview reflects the product as currently implemented and may change as the service evolves.