Security

We would rather name our providers than describe our security in adjectives. Here is what actually runs underneath.

Infrastructure

The application is served over HTTPS through Cloudflare. There is no unencrypted route to this site.

Your data

Application data is stored in Supabase, a managed PostgreSQL platform, in a project we control. Supabase encrypts data at rest and in transit as standard.

Payments

Payments are processed by Stripe. Card details are entered directly with Stripe and are never stored on our systems. We do not see your full card number.

Photographs

Photographs you submit for a consultation are stored in our Supabase database and processed by our AI analysis provider to produce your assessment. Our full privacy policy is being finalised with legal counsel and will be published here before launch. If you want your photographs or your account removed before then, contact us through our contact form and choose Privacy as the subject.

Reporting a vulnerability

If you believe you have found a security issue, tell us through our contact form and choose Security as the subject, with enough detail to reproduce it. We will acknowledge your report and keep you informed while we investigate. Please give us a reasonable opportunity to fix the issue before disclosing it publicly.

We do not currently run a paid bug bounty. We will credit you if you would like to be credited.

Last updated: October 2026.