Security

How SeedBasis protects your account and your idea, what we do not do, and how to report a vulnerability.

Last updated 23 October 2026 · Markdown version

Your idea is the thing you are most protective of. This page describes the security controls SeedBasis has today, in plain words, and changes when they do.

The short version

• Nobody at SeedBasis reads your idea or your reports to run the service. We never sell your data, and we do not train AI models on it.
• Passwords are hashed with Argon2id, must be at least 15 characters long, and are checked against known data breaches without being sent anywhere.
• Every account can turn on two-factor authentication with an authenticator app.
• The app loads no analytics and no third-party scripts, apart from the bot check where it is needed and, on the billing page, the payment provider's checkout.
• You can export everything in your account, or delete it, at any time.

1. Who can see your idea

• You. The server returns reports, notes and conversations only to the account that owns them.
• Not our staff, as a rule. Nobody at SeedBasis reads your idea or reports to run the service. We look at content only if you ask us to in a support request, if the law requires it, or to investigate a specific security incident or abuse.
• Our AI providers, to do the work. Google's Gemini models, and GLM-5.3 run by Fireworks AI and Together AI, all reached through OpenRouter, process your idea to research it and to answer your questions. Where a provider keeps anything, such as Google keeping Gemini requests for up to 55 days to detect abuse, the AI disclosure says what and for how long.
• Public data sources see search terms only. They receive terms derived from your idea, never the idea text.
• An assistant you connect can read your reports, and change their pages if you allowed editing, until you remove it or its token expires.
• Nobody through email. Our emails never contain your idea or report content.

2. Your account

• Passwords. Stored only as Argon2id hashes, using 19 MiB of memory and 2 passes. They must be 15 to 128 characters long, with no composition rules, and may not contain the name SeedBasis or your email address.
• Breached passwords. New passwords are checked against Have I Been Pwned's list of breached passwords through its range API: only the first 5 characters of a SHA-1 hash of the password leave our server, never the password or its full hash.
• Email confirmation. You must confirm your email address before you can sign in with a password, by typing a 6-digit code we email you. A code lasts 15 minutes, allows 5 tries and is stored only as a hash, and confirming never signs you in by itself. Unconfirmed password accounts are deleted after 72 hours.
• Google and Apple. Signing in with Google or Apple joins an existing account only when both sides have verified the same email address. Their sign-in tokens are stored encrypted.
• Two-factor authentication. Optional, with an authenticator app. The secret and your backup codes are stored encrypted, and five wrong codes pause two-factor sign-in for 15 minutes.
• Password guessing. After 3 wrong passwords within 15 minutes, signing in asks for a bot check. After 10, password sign-in to that account pauses for 15 minutes and we email you, at most once a day. Password reset and Google or Apple sign-in keep working, and sign-in answers the same way whether or not an account exists.
• Bot protection. Cloudflare Turnstile runs on sign-up and password reset, and on sign-in after repeated failures.
• Rate limits apply to signing in and up, password resets, verification emails, email changes, two-factor codes, data exports, checkout and account deletion.
• Sessions. A session ends after 7 days without activity, and 30 days after sign-in at the latest. Changing your password or two-factor settings signs out your other sessions, and you can see and end sessions in Settings.
• Sensitive changes need a recent sign-in: changing your email address or sign-in methods, creating an access token, exporting your data, opening the billing portal, and deleting your account without a password.
• Security emails. We email you about a sign-in from a new device, a changed password or two-factor setting, an added sign-in method, paused password sign-in, and attempts to sign up or change the email address on your account.

3. In your browser

• Every page is served over HTTPS, with HTTP Strict Transport Security.
• A Content Security Policy with a fresh nonce on every request lets only our own scripts run. Third-party scripts are allowed only where they are needed: Cloudflare Turnstile on sign-in pages, the payment provider's checkout on the billing page when it runs there, and Google Analytics on public marketing pages after you allow it.
• Other sites cannot put our pages in a frame, and responses tell browsers not to guess content types.
• The session cookie cannot be read by scripts in the page and, in production, is only sent over HTTPS.

4. Data in transit and at rest

• Traffic between your browser and SeedBasis is encrypted with TLS.
• The database runs on the same server as the app and accepts no connections from the internet. A database connection that leaves the server must use TLS with a fully verified certificate, or the app refuses it.
• Two-factor secrets, backup codes and Google or Apple sign-in tokens are encrypted before they are stored. Personal access tokens and password reset tokens are stored as hashes, so a copy of the database does not contain working tokens or links.
• Security records avoid raw personal data where they can: the security log keeps a coarse device description and a keyed hash of your network prefix instead of your IP address, and failed sign-in and rate-limit counters are keyed by keyed hashes. Active sessions do keep your IP address and browser details, so you can recognise them in Settings.
• Backups are kept for 14 days, so deleted data leaves them within that time.

5. AI and research

• Models that read content from the web cannot take actions of their own. Their output is structured data our code checks, and using a report credit or deleting one of your pages waits for your confirmation.
• SeedBasis Agent can change your report's pages when you ask it to. Every change is stored as a revision, marked as the agent's, listed in the answer that made it and undone in one click; it can only cite findings your report already has and only link to sites it already cites; and the original research is never touched.
• Connected assistants can only read unless you allow editing, and even then cannot start a report, spend a credit or delete a page of yours. Text sent to them is stripped of invisible characters that could hide instructions.
• The research pipeline fetches only public HTTPS addresses, so a model cannot make our servers reach internal systems.

6. What we do not do

• We do not sell your data or use it for advertising.
• We do not train AI models on your ideas or reports.
• We do not see or store your card details. Our payment provider handles payment.
• We do not send your idea text to public data sources or put it in emails.
• We do not run analytics or third-party trackers inside the app.
• We do not store passwords in a form that can be turned back into the password.
• We do not share your reports with investors, partners or anyone else.

7. Export and deletion

Export your data, in Settings, gives you one JSON file with your account, every report and revision, conversations, purchases, sessions and security events, without secrets. Delete account permanently removes your account and reports, including the archived original research. A few records stay without the link to you, as the Privacy Policy explains: security events for 12 months, and purchase and consent records for the periods accounting and consumer law ask for.

8. Infrastructure

The subprocessors page lists what each provider receives, where, and under which safeguards.

9. If something goes wrong

If a breach puts personal data at risk, we contain it, notify the data protection authorities within 72 hours where the law requires, tell the people affected without undue delay what happened, what it means for them and what they should do, and keep a record of it.

10. Reporting a vulnerability

If you find a security problem in SeedBasis, please email security@seedbasis.com. The same contact is published in our /.well-known/security.txt file.

• Tell us what you found, how to reproduce it, and what an attacker could do with it.
• We acknowledge your report within 3 business days, keep you updated, and aim to fix confirmed problems within 90 days, sooner for serious ones.
• With your permission, we credit you when the fix is published.
• We do not run a paid bug bounty.

Rules for security research

• Test only against your own account, or accounts whose owners have agreed.
• Do not access, change or delete anyone else's data. If you reach it by accident, stop, and tell us what you saw.
• Do not run denial-of-service tests, high-volume automated scans, spam, social engineering or physical attacks.
• Do not test our providers' systems, such as Stripe, Amazon Web Services, Cloudflare, Google, Apple, OpenRouter, Fireworks AI, Together AI or xAI. Report problems in them to those companies.
• Give us reasonable time to fix a problem before you disclose it, and do not share details with anyone else until then.

Safe harbour

If you research in good faith and follow these rules, we consider your research authorised, we will not take legal action against you for it, and if someone else does, we will make it known that you acted with our permission.