Security

Plain-language overview of how we handle authentication, payments, and your conversation data. For the formal vulnerability-reporting policy see Vulnerability Disclosure.

Authentication

Authentication is handled by Privy — email link, Google, GitHub, or external wallet. An embedded wallet is created automatically and identifies your account. Our backend issues a short-lived JWT after verifying a Privy token; that JWT lives in browser localStorage and is cleared on sign-out.

Payments

Premium-patterns payments are processed by Stripe (live mode, card payments). We never see or store your card number; Stripe handles the entire payment flow and sends an email receipt to the address on your Noospera account. The server-side webhook verifies signatures before promoting a job for limning.

Where your conversations live

Uploaded conversation files are stored on Noospera-managed servers (Railway, US-East). During processing we send the conversations to OpenAI for embedding and summarisation (under OpenAI's standard API terms — the data is not used to train OpenAI's models). The processed parquet, the noema essays, and the per-conversation summaries live on our backend so you can continue to explore your noospera.

Encryption posture

Data in transit is TLS everywhere — between your browser and our backend, between our backend and OpenAI / Stripe / Privy. Storage volumes on Railway are encrypted at rest by the underlying cloud provider. Field-level encryption of the conversation bodies themselves is on the longer-term roadmap; see Future Directions for the operative posture today.

Account and data deletion

You can request deletion at any time from /account. Account row and raw conversations are removed within roughly 14 days of receipt. Derived Artifacts (cluster essays, share-cards, anonymised aggregate stats) may survive deletion per the User Content License §5.

Reporting an issue

Found something? Send a coordinated disclosure to [email protected] following the Vulnerability Disclosure Policy. We commit to acknowledge in 3 business days.