Security

§ 01Our approach

We treat security as a core part of the product, not an add-on: we collect as little data as possible, limit access on a least-privilege basis and run sensitive operations only on the server.

§ 02Infrastructure and encryption

• The site and app run on widely used managed cloud infrastructure (Vercel, Cloudflare, Supabase).
• All connections are encrypted with TLS; HTTP requests are automatically redirected to HTTPS.
• Data in the database is protected by the provider's disk-level encryption.
• Service keys stored in the admin panel are additionally encrypted with AES-256-GCM.

§ 03Access control and data isolation

Every project belongs to a workspace. Workspaces are isolated by row-level security (RLS) rules in the database. Team members can act only within the rights of their role: owner, admin, analyst or viewer.

§ 04Keys and secrets

API keys for AI providers and other secrets are used only on the server and are never sent to the browser. Communication between the search-processing infrastructure and the app uses signed, authenticated requests.

§ 05Payment security

Card details never reach GeoDog's servers; payment happens on Polar's hosted, secure checkout. Payment notifications from Polar are not processed until their cryptographic signature has been verified.

§ 06Abuse prevention

Free searches and forms are protected by rate limits, bot verification and one-way hashed guest tokens. We do not store identity information to recognise guest users.

§ 07Reporting a vulnerability

If you believe you have found a security vulnerability, please write to security@geodog.co. Including the steps to reproduce the issue and its potential impact speeds up our review.

We will not pursue legal action against good-faith researchers; please avoid accessing others' data, disrupting the service, or disclosing the issue publicly before it is fixed.