Your data. Your signals. Secured.

GTM Radar is built on enterprise-grade infrastructure with security baked in at every layer — from the database to the deployment pipeline. Here is exactly how we protect your workspace and your data.

Infrastructure & Hosting

Database

Supabase — SOC 2 Type II

All workspace data lives in Supabase, which is independently audited to SOC 2 Type II. Data is encrypted at rest (AES-256) and in transit (TLS 1.2+). The Postgres instance is not publicly accessible — all queries route through authenticated, row-level-scoped connections.

Hosting

Vercel — SOC 2 Compliant

The GTM Radar application runs on Vercel's edge network, which maintains SOC 2 compliance. TLS is enforced on every request. Build artifacts and environment variables are isolated per deployment — no shared secrets across tenants.

Data Isolation

Multi-tenancy

Row-Level Security at the DB layer

Every data table is scoped to a workspace_id. Supabase's Row-Level Security (RLS) policies are enforced inside Postgres — not in application code — making cross-workspace data access impossible by design, even in the event of an application-layer bug.

Principle of least privilege

No over-privileged queries

Public-facing APIs use the Supabase anonymous or user-scoped key with RLS active. Service-role access (which bypasses RLS) is used only for server-side administrative operations — cron jobs, data pipeline ingestion — and is never exposed to the client.

Authentication & Sessions

Auth

Supabase Auth with JWT sessions No passwords stored

✓Email-based magic-link login — no password hashes stored anywhere in GTM Radar's systems.
✓Sessions are short-lived JWTs signed by Supabase. Tokens are validated server-side on every privileged request.
✓Workspace admin access requires an email allowlist configured by the platform administrator — open sign-up is disabled.
✓Platform admin role is entirely separate from workspace admin — a workspace admin cannot elevate to platform-level access.

Secret Management

Secrets

API keys encrypted in environment variables

✓All API keys (Supabase service role, third-party data providers, LLM APIs) are stored as Vercel environment variables — encrypted at rest and injected only at build/runtime.
✓Secrets are never committed to source control. The repository contains no plaintext credentials.
✓Secrets are never written to logs, error traces, or client-visible responses.
✓Key rotation is performed out-of-band via the Vercel dashboard and Supabase console — no downtime required.

Signal Data Sources

Public sources

Crawled from the open web

GTM Radar collects signals from sources that are freely accessible to the public: StackExchange (via public API), GitHub (public repositories and activity), Reddit (public posts via API), news publications, SEC EDGAR (US government disclosure data), and ATS job board postings. These sources have no expectation of privacy.

Licensed data

Vetted third-party brokers

We also purchase supplementary data from third-party data brokers under formal data processing agreements (DPAs). Each provider is evaluated for compliance posture before onboarding. Purchased data is used only to enrich signal context — it is not resold individually.

What We Do Not Store

Data minimization

We deliberately do not collect the following

✓Passwords — we use magic-link auth exclusively.
✓Payment card data — billing is handled by a PCI-compliant third-party processor; we never see raw card numbers.
✓Social Security Numbers or national identity numbers.
✓Health, biometric, or other special-category personal data as defined by GDPR Article 9.

GDPR & CCPA

Privacy rights

Data subject requests honored within 30 days

✓If you believe information about you appears in GTM Radar's signal database, you may request deletion or correction at any time.
✓We process only publicly available data in Signal Data — no sensitive categories.
✓California residents may request access, deletion, or opt-out of data sharing under CCPA/CPRA.
✓To submit a request, email asaf@linkedotter.com with the subject line 'Privacy Request'. We will acknowledge within 5 business days and resolve within 30 calendar days.

Vulnerability Disclosure

Security disclosure

Responsible disclosure policy

If you discover a security vulnerability in GTM Radar, please report it to asaf@linkedotter.com with a description of the issue and steps to reproduce. We commit to:

✓Acknowledge your report within 48 hours.
✓Provide a status update within 7 business days.
✓Remediate critical vulnerabilities within 7 days of confirmation.
✓Not pursue legal action against researchers acting in good faith under this policy.

We do not currently offer a bug bounty program, but we will credit researchers publicly upon request when a valid finding is resolved.

Page Updates

Transparency

This page is kept current

This Security & Trust page is updated whenever we make material changes to our security posture, infrastructure, or data practices. The effective date in the page footer reflects the most recent revision. If you have questions about any item on this page, contact us at asaf@linkedotter.com.