Security at Aloud

Supabase Auth provides email-based authentication. Server routes validate the authenticated user before loading workspace data. Workspace-owned database records carry an immutable workspace boundary and application queries are scoped to it.

Application tables are not available to public Supabase Data API roles. Row-level security is enabled as a second boundary, and database access is performed by trusted server-side code. Workspace roles restrict operations such as running studies, changing settings, and deleting data.

Screenshot bytes are stored in a private object bucket; the database stores evidence metadata. The product serves evidence through authorized application routes rather than permanent public bucket URLs. Evidence and share routes are marked not to be indexed, and report share links can be revoked or set to expire.

For production-type environments, redaction is required. Aloud identifies sensitive page regions and places opaque masks over them before producing report-safe derivatives. Because no automated redaction system can guarantee that a live page contains no secret, customers should still use seeded test data and review evidence before sharing it.

The Aloud runner executes browser sessions on customer-controlled infrastructure when a private or local environment requires it. Runner credentials are stored locally with owner-only file permissions, and the server stores runner tokens as hashes. Credentials can be revoked.

The runner intersects the study's requested domains with the runner's permitted hosts. Browser and network guards block off-domain navigation and private-network targets unless the operator explicitly permits them. Customers remain responsible for the environment, test accounts, allowlist, and actions they approve.

Service credentials are loaded from protected environment configuration. Provider credentials are not placed in model prompts, logs, screenshots, analytics, or reports. Model calls pass only the screenshots and structured context required for the task to the configured AI provider.

Aloud uses managed providers for hosting, authentication, storage, AI processing, analytics, and payments. Traffic to those services uses encrypted HTTPS connections. Stripe hosts checkout and payment management, so Aloud does not store full card numbers.

The web application sets transport security, anti-framing, content-type, permissions, and referrer-policy headers. Evidence responses are not intended for shared caches. Share tokens and object identifiers are removed from product analytics URL properties.

PostHog autocapture, recordings, heatmaps, DOM text capture, performance capture, and automatic exception capture are disabled. Aloud sends only reviewed, structured analytics events and identifies users and workspaces by internal IDs rather than email addresses or names.

Workspace retention settings govern study evidence and default to 90 days. Owners can delete studies and runs. Deletion revokes related report access and removes evidence through a retryable workflow designed not to leave publicly accessible remnants.

Operational, audit, usage, and billing records may have different retention needs. See the Privacy Policy for the categories of information Aloud processes and the reasons records may be retained.

Use staging or seeded environments where possible. Create scoped test accounts, limit allowed domains, require redaction for sensitive environments, review high-impact actions before approval, revoke unused runners and report links, and delete evidence that is no longer needed.

Do not provide production secrets, real payment details, regulated data, or personal information that is unnecessary for a study. Tell us promptly if you believe an account, runner credential, share link, or evidence asset has been exposed.

Email the address shown on this page with the subject “Security report.” Include the affected URL or component, steps to reproduce, potential impact, and a safe way to contact you. Do not include real customer data, access another customer's workspace, degrade the service, or publicly disclose an unresolved issue.

We will acknowledge a good-faith report, investigate it, and work toward a proportionate fix. Aloud does not currently operate a paid bug-bounty program. Contact us before testing if your work could affect other users or production data.