1. Security Overview
GuidMe is built around tenant isolation, authenticated access, API-key validation, Supabase row-level security, private uploads by default, short-lived AI tokens, rate limiting, and PII-redacted observability where implemented.
2. Technical Controls Observed
- HTTPS/WSS for app, API, and widget traffic through hosted infrastructure.
- Supabase authentication, PostgreSQL, storage, and RLS for tenant and user data.
- Hashed API keys or key prefixes rather than full plaintext API keys in normal operation.
- Ephemeral AI session tokens for direct voice/vision connections.
- Cloudflare Turnstile on selected public forms and rate limiting on backend routes.
- Sentry, OpenTelemetry, New Relic, Better Stack, Checkly, and related monitoring with documented PII-redaction guardrails.
- Security runbooks, vulnerability-management docs, and security-check scripts in the repository.
3. What This Policy Does Not Claim
This page does not claim GuidMe itself is SOC 2, ISO 27001, HIPAA, PCI DSS, or otherwise certified. Some infrastructure providers may have their own certifications. Any customer-facing certification, insurance, audit, penetration-test, or "bank-level security" claim requires evidence and owner/lawyer approval.
4. Vulnerability Reporting
Report suspected vulnerabilities to support@guidme.ai with the subject "Security Issue". Do not access, modify, destroy, exfiltrate, or disclose data that does not belong to you, and do not disrupt the Service or customer deployments.
5. Incident Response
GuidMe maintains incident-response and security runbook documentation. Personal-data breach notification obligations depend on the incident, affected data, customer relationship, and applicable law. Final external notification commitments require legal review.