This page states what is actually true about how GrowthAgents is hosted and how data is protected. We do not claim a certification, audit, or guarantee the platform has not earned.
1. Where the platform runs
The web application is hosted on Vercel. The primary database is Supabase Postgres. Background content-generation and audit work runs on workers on a separate VPS, polling the database rather than running as part of the website itself.
2. Secrets and credentials
Application secrets are held in AWS Secrets Manager. Stored third-party credentials, such as WordPress publishing passwords, are kept encrypted in the database rather than in plain text.
3. Tenant isolation
The database does not use Postgres row-level security. Tenant isolation — keeping one firm’s data separate from another’s — is enforced in the application layer, not the database layer. We are stating this directly rather than implying a database-level guarantee that does not exist.
4. Payments
Billing is processed by Stripe. GrowthAgents does not store full payment card numbers.
5. What we do not claim
We do not hold an independent security-management certification, we have not commissioned an independent offensive security assessment of our infrastructure, and we do not describe our infrastructure as guaranteeing encryption at rest. We are not going to describe our security posture in marketing superlatives either — what is written above is the whole of what we can currently state as fact. If any of this changes and is independently verified, this page will say so and name the report.
6. Reporting a security issue
If you believe you have found a security issue, tell us what you found and how to reproduce it before disclosing it publicly.
7. Changes to this page
This page is a working draft pending counsel review.
8. Contact
Security reports and questions go to security@growthagents.ai.