Security

Competitor Move is a small product in private beta. This page describes, plainly, what we do today to protect your data — and what we don’t have yet.

Hosting and data storage

• Database: Supabase (managed Postgres). Every product table is protected by row-level security: queries are scoped to the workspaces you belong to by the database itself, not only by application code.
• Application and website: hosted on Vercel.
• Our full list of providers is in the subprocessor list in our Privacy Policy.

Encryption

• In transit: all traffic to the website and app is served over HTTPS (TLS).
• At rest: data is encrypted at rest by our providers (provider-managed keys).

Access control

• Passwordless sign-in: one-time email links or Google sign-in, via Supabase Auth. We never store passwords.
• Private beta gate: only approved waitlist members and invited teammates can create or join a workspace.
• Workspace roles (owner, admin, member) are enforced in the database.
• Secrets stay server-side. API keys for AI, email and database admin access live only in server environment variables and are never sent to the browser. Privileged database access is limited to server-only code paths.
• Rate limiting on expensive or sensitive actions (crawls, manual re-checks, report generation, test and manual sends, invitations), enforced atomically in the database and failing closed.

Crawler safeguards

• The crawler fetches public pages only — homepage, pricing page, sitemap/robots.txt, and changelog or release-notes pages. It never logs in, submits forms or bypasses access controls.
• SSRF protection: every address a hostname resolves to must be public (private, loopback, link-local and similar ranges are rejected for IPv4 and IPv6), only ports 80/443 are allowed, the connection is pinned to the validated IP so DNS rebinding can’t redirect it, and each redirect hop is re-validated (max 5). Responses are size- and time-capped.
• The optional headless-browser fallback applies the same target validation to every URL it renders.

Outbound webhooks and Slack

• Delivery URLs must use https:// and resolve only to public IP addresses; the connection is pinned to the validated IP.
• Redirects are never followed — a 3xx response counts as a failed delivery.
• Response bodies from your endpoint are discarded and never shown back, so deliveries can’t be used to read internal services.
• Custom webhooks are signed with HMAC-SHA256 using a per-channel whsec_… secret you can rotate in Settings. See the webhook docs for verification code.

Data retention and deletion

• Failed scans are deleted after 30 days; completed scans after 180 days (the latest 3 per competitor are kept).
• Rate-limit records are deleted after 30 days.
• You can delete your account in Settings. If you are the only member of your workspace, the workspace and all of its data are deleted with it.

Details are in the Privacy Policy.

Monitoring

Application errors are reported to Sentry, and scheduled jobs alert us when scans or deliveries fail so we can respond quickly.

Responsible disclosure

If you believe you have found a security vulnerability, please email security@competitormove.com (also listed in our security.txt). Include steps to reproduce and the impact you observed.

• Give us reasonable time to fix the issue before disclosing it publicly.
• Only test against your own account and workspace; don’t access other users’ data, degrade the service, or run automated scans at volume.
• We will acknowledge your report, keep you updated, and credit you if you wish. We don’t currently run a paid bug bounty.