--- title: "Trust & security" description: "BOSLA sits between you and your feed, so you should know exactly what it sees and keeps. It is a personal control layer for your attention: it doesn't need your data to work, we don't sell it, there are no ads, and we don't build a profile of you. This page explains, in plain words, where data goes and what protects it today, and is honest about what isn't done yet." url: https://boslaai.co/trust language: en --- # Trust & security > BOSLA sits between you and your feed, so you should know exactly what it sees and keeps. It is a personal control layer for your attention: it doesn't need your data to work, we don't sell it, there are no ads, and we don't build a profile of you. This page explains, in plain words, where data goes and what protects it today, and is honest about what isn't done yet. ## Our practices - **No ads, no data sales** — BOSLA has no advertising and we don't sell or rent your information. The site loads no ad or tracking scripts. - **Counting visits without following you** — Unique visitors are counted with a one-way, salted hash of your network address and browser family. No cookie is set for it, the raw address isn't stored, and the count is never linked to an account. - **Only the cookies the site needs** — Cookies keep you signed in, remember your language and credit a friend's invite. There are no advertising or analytics cookies. - **The assistant doesn't keep your chats** — Your conversation stays in your browser tab and is gone when you close it. We record only that a question was asked, not what it said. - **AI only when you ask** — Your questions reach our AI provider, Anthropic, only when you use the assistant. Visitors who aren't signed in send nothing about any account. - **We never see your password** — Member sign-in is handled by Clerk. We keep your account id, email, first name and invite points, not your password. - **A human approves AI edits** — When an AI tool helps write the site, its changes to live pages are saved as proposals. A person on our team reviews and approves each one. - **Your data, your request** — You can ask us what we hold about you, or ask us to delete it, through the contact page or the email below. ## Where your data goes Every path data can take, from your browser to the services behind the site. Retention periods are not yet defined. See the privacy policy for the current wording. - **Your browser** — Pages you open, forms you send, questions you ask the assistant. - **BOSLA servers (Netlify)** — Run the website and decide what is stored or passed on. - **Database and files (Supabase)** — Accounts, sign-ups, messages, anonymous counts, uploaded images. - **Sign-in (Clerk)** — Your email and sign-in details, to keep your account safe. - **Email (Resend)** — Notifies our team about messages you send us, when email is configured. - **AI assistant (Anthropic)** — Your question and the site's content, only when you use the assistant. ## Who processes data for us Only the services the site actually uses. We will update this list before adding a provider that handles personal information. Provider Purpose Data Location - Netlify — Website hosting — Requests to the site — See the provider's policy - Supabase — Database and image storage — Account records, sign-ups, messages, anonymous counts, images — See the provider's policy - Clerk — Member sign-in and account security — Email, name if you add it, sign-in devices — See the provider's policy - Anthropic — The AI assistant (Claude) — Your questions; for members, first name, points and invite link — See the provider's policy - PostHog — Anonymous usage statistics — Which pages and actions, under the same pseudonymous id as the visitor count — sent by our server, never by your browser — See the provider's policy - Resend — Email notifications to our team — The message you sent and your reply-to email — See the provider's policy ## Security controls Protections that are in place in the code today. - HTTPS only, enforced with HSTS on every page. - Security headers on every page: no framing, no MIME sniffing, a strict referrer policy, and camera, microphone and location turned off. - A baseline Content Security Policy that blocks plugins, base-tag hijacking and framing. - Team passwords hashed with bcrypt; admin session tokens stored only as hashes, in httpOnly cookies. - Rate limits on team sign-in, forms, the assistant, analytics and the AI integration. - The AI provider key is sealed with AES-256-GCM before it is stored. - Uploaded images are type-checked, SVGs with scripts or links are refused, and uploads are served sandboxed. - The assistant only answers requests from the site's own pages. - Analytics without cookies, raw IP addresses or links to accounts. - AI integration tokens stored hashed; AI edits to live content wait for human approval. ## Where we are What is done, what is under way, and what is still planned. Item Status What it means Done In progress Planned - Security headers and HTTPS — Applied to every page of the site. - Cookie-free visitor counts — Salted hash of network address and browser family, never linked to accounts. - Privacy and cookie policies — Published as a working draft; not yet reviewed by legal counsel. - Data retention periods — Not yet defined. The privacy policy will state them. - Full script Content Security Policy — Extending the baseline policy to control which scripts may run. - Independent security review — An outside penetration test of the site and its APIs. ## Report a problem Found a vulnerability, or have a privacy request? Tell us. Please give us reasonable time to fix a security issue before making it public. Write to Use the contact page The details are in our Privacy policy Cookie policy