Current security posture
Passwordless authentication
Sign-in is magic-link only via Supabase Auth. We store zero passwords. Auth emails are sent through Resend from auth@stack-match.io over TLS.
Data encryption
All data is encrypted in transit via HTTPS and at rest via Supabase's managed Postgres (AES-256). Our hosting provider (Vercel) and database provider (Supabase) both run on hyperscaler infrastructure with SOC 2 Type II attestation.
Row-level security (RLS)
Every user-data table enforces Postgres RLS policies. Users can only read/write their own rows. Admin access is gated behind an explicit is_admin flag and separate policies.
Secrets management
API keys (Anthropic, Resend, Stripe, Supabase service-role) are stored only in Vercel environment variables, never in source control. Server-side routes are the only place they're read.
Rate limiting
Submission endpoints (tool submissions, RFPs, vendor responses) are throttled to prevent spam and abuse: 3 tool submissions per email per 24h, 3 RFPs per buyer per 24h, 10 vendor pitches per vendor per 24h.
No sold buyer data
We sell aggregated, anonymized intent signals to vendors — never individual user information. Specific users, emails, company names, and RFP contents are never exposed without the buyer's explicit unmask action.
Integrity-first content
All community reviews shown on tool pages are from real users. All editorial reviews are bylined StackMatch Editorial and clearly marked as independent analyst commentary. We do not accept payment for verdicts.
Compliance roadmap
SOC 2 Type I
We are working toward SOC 2 Type I to validate our control environment. Expected vendor: Drata or Vanta. Timeline: 3-6 months from audit kickoff.
SOC 2 Type II
Type II observation period begins after Type I completion.
GDPR & data processing addendum
We are drafting a standard DPA for vendor and enterprise customers who require one. If you need one now, email legal@stack-match.io and we'll expedite.
Penetration test
Annual third-party pentest, scoped to include the platform application and authentication surface.
Responsible disclosure
If you've found a security issue, we want to hear about it. Please email security@stack-match.io with reproduction steps, impact, and your preferred acknowledgement credit.
What to include: scope (URL or endpoint), a working proof-of-concept, the impact (what can an attacker do?), and how you want to be credited (or "no credit needed").
What to avoid: do not test on other users' accounts, do not run automated scanners that generate volume, do not exfiltrate or disclose data publicly before we fix.
Response time: initial acknowledgement within 48 hours. Fix timeline depends on severity. We'll coordinate public disclosure with you once a fix is live.