Security Policy

1. Data Encryption

All user data, including login credentials, social tokens, semantic vectors, and indexed post contents, are encrypted both in transit (using TLS 1.3) and at rest (using AES-256 encryption standards). This ensures that your social archive remains securely shielded.

2. Token and Credential Security

We use secure OAuth 2.0 flows to connect to external accounts (LinkedIn, X, Reddit). We request the minimum scopes required to fetch post history. Your authentication tokens are stored securely in Supabase Auth sessions using Row Level Security policies, which prevent unauthorized read access.

3. Third-party Processing & LLMs

Preve is built with search and retrieval privacy as a priority:

• Your posts are never shared with advertising networks or third-party data broker services.
• Embeddings are created using dedicated secure API endpoints, and we enforce a strict policy of zero-data-retention for model training.

4. Vulnerability Disclosure

We welcome reports of security vulnerabilities. If you discover a security issue on Preve, please contact us at security@preve.com. We pledge to review and remediate all verified security issues within 72 hours.