How We Protect Your Data
Ambrosia Ventures handles sensitive deal intelligence for biopharma companies. We treat every calculation input, valuation output, and partner search as confidential. Here is exactly how.
Your data is yours
We never use your calculation inputs to train models, enrich our database, or share with other customers.
Encrypted everywhere
All data is encrypted in transit (TLS 1.2+) and at rest. We never store payment card data.
We never sell data
We do not sell, rent, or trade personal information or calculation data to any third party.
Infrastructure Security
- Application hosted on Vercel (SOC 2 Type II compliant). Edge network with automatic DDoS protection and global CDN.
- Database hosted on Supabase (SOC 2 Type II compliant, ISO 27001). Data encrypted at rest with AES-256. Hosted in AWS US-West-2 with automated backups.
- All traffic encrypted via TLS 1.2+ (HSTS enforced with 2-year max-age). No unencrypted HTTP connections accepted.
- Payment processing through Stripe (PCI DSS Level 1 compliant). Card data never touches our servers.
- DNS and edge security via Cloudflare with automatic SSL certificate management.
Application Security
- Content Security Policy (CSP) headers restrict script execution, frame embedding, and form submissions to trusted origins only.
- CSRF protection on all mutating API endpoints (POST/PUT/DELETE/PATCH) with origin and referer validation.
- Route-specific rate limiting via Upstash Redis — calculation endpoints, authentication, and API routes each have independent limits to prevent abuse.
- Security headers enforced on every response: X-Frame-Options (SAMEORIGIN), X-Content-Type-Options (nosniff), Referrer-Policy (strict-origin-when-cross-origin), Permissions-Policy.
- Stripe webhook signature verification with timing-safe comparison prevents forged payment events. Idempotency enforcement via unique constraint prevents duplicate processing.
- Cron endpoints protected with timing-safe Bearer token validation — not accessible via public URL.
Authentication & Access Control
- PKCE (Proof Key for Code Exchange) authentication flow via Supabase Auth — industry standard for secure OAuth/session management.
- Single-session enforcement: concurrent logins from multiple devices are blocked via session nonce validation. One active session per account.
- Server-side tier resolution: subscription tier (Free/Pro/Report) is validated server-side on every request. Client-side state cannot spoof access.
- Row-Level Security (RLS) on all database tables: users can only read and modify their own profiles, calculations, events, and sessions. Enforced at the database layer, not application layer.
- Service role access is restricted to server-side operations (webhooks, cron jobs, admin endpoints). No client-side code has service-level database access.
- Secure password reset tokens with single-use enforcement and time-based expiration.
Data Handling & Isolation
- Calculation inputs are stored only for your account history and are never shared with other customers, used to enrich our deal database, or fed into model training.
- Shared calculation links are access-controlled: each share link has a unique token, optional expiration, and view tracking. Recipients see a locked-down read-only view.
- Report purchases and PDF exports are tied to your account. Generated reports are not stored on public URLs or indexed by search engines.
- Account deletion removes all personal data within 30 days, including calculation history, profile data, and session records.
What we do NOT store
- - Payment card numbers, CVVs, or bank details (handled entirely by Stripe)
- - Passwords in plaintext (hashed via Supabase Auth with bcrypt)
- - IP addresses in calculation records (used only for rate limiting and fraud detection, not persisted with your data)
Compliance & Privacy
California residents can request access, deletion, and opt-out. We do not sell personal information.
EEA residents have rights to access, rectify, erase, restrict, port, and object. Legal basis: contract performance and legitimate interests.
All payment processing handled by Stripe (PCI Level 1). Card data never enters our infrastructure.
Service is not intended for individuals under 18. We do not knowingly collect information from minors.
Sub-Processors
Third-party services that process data on our behalf:
| Provider | Purpose | Data Processed |
|---|---|---|
| Vercel | Application hosting & CDN | Request logs, edge function execution |
| Supabase | Database & authentication | Account data, calculations, sessions |
| Stripe | Payment processing | Payment details, billing info |
| SendGrid | Transactional email | Email address, email content |
| Sentry | Error monitoring | Error traces (PII scrubbed) |
| Upstash | Rate limiting | Request counts (ephemeral) |
Responsible Disclosure
If you discover a security vulnerability, please report it to support@ambrosiaventures.co. We take all reports seriously and will respond within 48 hours.
Please do not publicly disclose vulnerabilities before we have had an opportunity to address them.