Security

Practices

• The site is served over HTTPS.
• Passwords are handled by Supabase Auth, not stored in plain text by Simvolve.
• Cloud simulations are scoped to your user with row-level security in the database.
• The OpenAI API key lives on the server. Browsers cannot call the model with our key.
• API routes check authentication where needed and apply rate and payload limits.
• Payments go through Stripe. We store customer and subscription IDs, not full card numbers.

What you can do

• Use a unique password and keep the account email you can still access.
• Do not paste API keys, passwords, or other people’s private data into a simulation.
• Sign out on shared devices, or use Log out of all devices in account settings to end every session on the account.
• Delete simulations or the whole account in settings when you no longer need them.

Limits

No product is perfectly secure. Guest saves live in the browser; anyone with access to that device can read them. AI providers process prompt text as described in the AI policy. If we learn of a breach that affects your personal data, we will take reasonable steps to notify you and the people the law requires us to notify.

Report a vulnerability

If you believe you found a security issue, email simvolve@gmail.com with the subject “Security report”. Include enough detail for us to reproduce it. Please do not access other people’s data or disrupt the service while testing. We will not offer a bounty unless we later publish one, but we will take good-faith reports seriously.