1. Infrastructure
Moonstreak runs entirely on established cloud providers with independently audited security programs: Vercel (hosting and delivery), Neon (managed PostgreSQL), and Amazon Web Services (email via SES, file storage via S3).
These providers maintain SOC 2 and/or ISO 27001 certifications for the infrastructure layer. Moonstreak itself is not separately certified — we build on their certified infrastructure and keep our own application layer small and auditable.
2. Encryption
In transit: all traffic to and within Moonstreak is encrypted with TLS. There is no unencrypted access to the app or API.
At rest: database storage (Neon) and file storage (AWS) encrypt data at rest as part of the managed platform.
3. Payments
Payments are handled by Paddle, our merchant of record. Your card details are entered directly into Paddle's PCI DSS–compliant checkout and never touch our servers. We store only subscription status and billing metadata — never card numbers.
4. Authentication & sessions
Sign-in is via Google or GitHub OAuth, or email magic links. Moonstreak does not store passwords — there are none to steal.
Sessions use encrypted, httpOnly cookies that JavaScript cannot read.
Signing out of a deleted or compromised account is enforced server-side: we version session tokens, so all of a user's sessions can be revoked at once.
5. Application security
Every API route is wrapped in authentication middleware, and organization data is scoped server-side — one workspace can never query another's data.
All input is validated with strict schemas before it reaches the database.
Rate limiting protects sign-in and API endpoints from abuse.
Security-relevant events (sign-ins, failed logins, data exports, deletions) are logged for incident investigation.
6. Your data, your control
Delete your account yourself in Settings → Danger zone. Your personal details are anonymized immediately; after a 30-day grace period (with an undo link, in case of mistakes) everything is permanently deleted.
Export your data from Settings → Export.
Details on what we collect and your rights under GDPR are in our Privacy Policy.
7. AI features
Sparky, our AI assistant, uses the Google Gemini API. Prompts sent to the API are covered by Google's API data-use terms, under which they are not used to train Google's models. You can view and delete AI memories at any time in Settings.
8. Sub-processors
The full list of third-party services that process personal data on our behalf is maintained in our Privacy Policy.
9. Responsible disclosure
Found a vulnerability? Please email security@moonstreak.app with steps to reproduce. We'll acknowledge your report promptly, keep you informed while we fix it, and credit you if you'd like. Please don't access other users' data or degrade the service while testing.
10. Questions
Security questions from customers and their clients are welcome: security@moonstreak.app.
Questions about any of this? Email hello@moonstreak.app — you'll get Ásgeir, because there is no one else to get.