Trust
Security, stated plainly
This page describes only what is already built and running — no aspirations, no certifications we do not hold. Each item below maps to behaviour in the codebase today.
What is true today
1
Payments happen on Stripe, not here
When you pay, you are sent to a checkout page hosted by Stripe. Your card details are entered there and go to Stripe directly — they never touch our servers, and we store no card numbers.
2
Your work is isolated in the database
Every table that holds tenant data in our Postgres database has row-level security enabled and forced, and each request runs bound to your tenant. The database itself refuses reads and writes that cross that boundary.
3
Captured requests are encrypted
Where we keep an audit copy of the exact requests sent to our model providers, the captured bodies are encrypted with authenticated encryption before they are stored, and expire on a scheduled purge.
4
Outbound searches are redacted
Before a web search leaves our infrastructure, the query passes through a redactor that strips the personally identifying details it detects — email addresses, phone numbers, government identifiers, card-like numbers, and network addresses. Fetched evidence is redacted the same way before it is stored.
5
Sign-in is managed by Clerk
Authentication is handled by Clerk, a dedicated identity provider. We never see or store your password, and every request to our backend is verified against your session before it touches your data.
6
Analytics is first-party and opt-in
The only analytics on our pages is our own, and it collects nothing unless you consent — you can change your choice at any time from the footer. There are no third-party trackers, no advertising pixels, and no sale of data.
What we do not claim
Falsifai is a closed alpha run by a small team. We hold no formal security certifications yet, and we will not claim one until an independent auditor says we have earned it.
Found something?
If you believe you have found a vulnerability, write to privacy@falsifai.ai. Our disclosure policy is published at /.well-known/security.txt. For anything else, support@falsifai.ai reaches us — we aim to respond within 2 business days.