How we protect your data.
What we do today, stated plainly. Where a protection is provided by one of our hosting providers, we say so.
Last updated: October 12, 2026
Hosting and encryption
Where your data lives
The database and authentication run on Supabase. The API and background jobs run on Render in the United States (Oregon). The web app runs on Vercel. Every provider we use is listed in our subprocessor list.
Encryption in transit
Traffic to pravado.io, app.pravado.io and our API is served over HTTPS (TLS). The web app sends HTTP Strict Transport Security (HSTS) headers so browsers refuse plain HTTP.
Encryption at rest
Data in our database is encrypted at rest by Supabase, our database provider (AES-256, per Supabase's documentation). Card details are held by Stripe; we never store full card numbers.
Tenant isolation and access control
Your organization's data stays yours
- Database row-level security (RLS) limits each signed-in user to the data of their own organization.
- The API resolves your organization on the server from your session. It never trusts an organization ID sent by the browser, and unauthenticated data requests are refused.
- Team roles (owner, admin, member) control who can change billing and settings.
Sign-in
- Authentication is handled by Supabase Auth: email and password, a one-time email link, or Sign in with Google or Microsoft.
- Passwords are never stored by Pravado in plain text; Supabase Auth stores only a hash.
How the product handles sensitive actions
Secrets
API keys and credentials live in our hosting providers' environment settings, never in source code. The web app holds no payment secret keys. Webhooks from Stripe and our email provider are accepted only with a valid signature.
Human approval
Nothing is sent without an owner's or admin's approval: they can send a pitch they wrote or edited after a final confirmation, and every other pitch, including an unedited AI draft, waits in Approvals. Pravado prepares content; your own CMS publishes it.
Journalist contact data
Journalist email addresses are never shown, exported or returned by our API. Pravado looks up an address only when you create a pitch, and sends through its own mail service.
Abuse protection
The API applies security headers and per-organization rate limits. Spending on AI and data vendors is capped per organization, and the caps fail closed.
Error monitoring
Error reports are scrubbed of email addresses, cookies and authorization headers before they are sent to Sentry.
Analytics
Product analytics in your browser start only after you accept analytics cookies. See our Cookie Policy.
Certifications and agreements
Certifications
We do not hold SOC 2 or ISO 27001 certification today. If your review needs more detail than this page, contact us and we will answer your security questionnaire.
Data Processing Addendum
Business customers can review our Data Processing Addendum and request a signed copy.
Report a vulnerability
If you believe you have found a security issue, email security@pravado.io (or its alias secops@pravado.io) with "Security report" in the subject. Our security.txt lists the same contact. Please include the steps to reproduce it, give us reasonable time to fix it before disclosing it, and do not access other customers' data, degrade the service or use social engineering. We will acknowledge your report and keep you updated. We do not run a paid bug bounty.