Defence in depth
Authentication, database RLS, server-only keys, and validation layers protect your workspace.
Legal
Security
How Foundry protects accounts, project data, and published sites — plus how to report vulnerabilities responsibly.
Last updated 25 July 2026
Foundry uses Clerk for auth, Supabase with row-level security, and server-only secrets for AI and deployment. Report security issues privately before public disclosure.
Least privilege
Internal tables are not exposed through the public Data API. Authorization does not rely on user-editable metadata.
Responsible disclosure
We acknowledge valid reports within two business days and work with researchers to remediate issues.
Security overview
Foundry handles sensitive business ideas, generated intellectual property, and deployment credentials. Security is built into the architecture — not bolted on after launch.
Shared responsibility
We secure the platform; you secure your account credentials, review published content, and manage who you invite to projects.
Infrastructure & hosting
Application hosting
The Foundry app and API run on Vercel with TLS in transit.
- Environment secrets stored as encrypted env vars.
- Production and preview environments isolated.
Database
Project data lives in Supabase Postgres.
- Row-level security on exposed tables.
- Service-role access limited to server-side code paths.
Authentication
Clerk manages sign-in, sessions, and OAuth.
- Session cookies are HttpOnly where supported.
- App routes under (app) require authentication via proxy middleware.
Data protection
- AI provider keys, database secrets, and deployment tokens never ship to the browser.
- Only NEXT_PUBLIC_* variables are intended for client exposure.
- Generated site previews use sandboxed iframes where applicable.
- Workspace memory embeddings are scoped per workspace and stored server-side.
Access control summary
| Layer | Control |
|---|---|
| API routes | Clerk session + project membership checks |
| Database | RLS policies; no public grants on internal tables |
| Collaboration | Project invite tokens scoped to project access |
| Published sites | Public read; write via authenticated publish flow only |
| Invites | Token-based links with role assignment |
Generation pipeline security
Long-running generation runs through Inngest with step isolation. E2B sandboxes compile generated React code in ephemeral environments rather than on production servers.
- Validation runs before publish; deployment is marked live only after URL verification.
- User-facing errors omit internal stack traces and provider logs.
- Retry and idempotency patterns reduce duplicate side effects.
Account security practices
- Use a strong, unique password or OAuth with MFA enabled on your identity provider.
- Review project members and revoke access when collaborators leave.
- Do not share invite links publicly unless you intend open access.
- Sign out on shared devices.
Incident response
We monitor for abuse and anomalous patterns. If we confirm a breach affecting personal data, we will notify affected users and regulators as required by law.
Reporting vulnerabilities
Email support@tryfoundry.app with the subject line "Security report". Include steps to reproduce, impact assessment, and any proof-of-concept. Please encrypt sensitive details if your mail client supports PGP.
- We aim to acknowledge reports within two business days.
- Please allow reasonable time to investigate and fix before public disclosure.
- Do not access data belonging to other users or disrupt service.
- Good-faith research is welcome; we will not pursue legal action for responsible disclosure.
Out of scope
Social engineering, physical attacks, denial-of-service tests, and issues in third-party services without a Foundry-specific impact are generally out of scope.
Compliance & certifications
Foundry relies on subprocessors that maintain industry certifications (for example, SOC 2). We are evaluating formal compliance programs as the product scales. Enterprise customers may request a subprocessor list and security questionnaire via support.
Related policies
Review the other legal documents that apply to your use of Foundry.
Need help?
Questions about security? Contact support@tryfoundry.app. For account access, include the email on your Foundry account.
Get started with Foundry