Specifics, not slogans.
Encryption, sessions, backups, and what we’d do if a specific thing broke. For the “why we don’t train on your chats” and subprocessor list, see /trust.
In transit
Every network hop uses TLS 1.3 with HSTS. No plaintext traffic between you, our app, our database, or our inference provider.
At rest
Chat contents + attached files are encrypted at rest via Supabase's disk encryption (AES-256 on AWS). Backup snapshots inherit the same encryption.
In inference
Your message is transmitted to Anthropic over TLS, processed ephemerally, and the response is streamed back. Anthropic's retention policy on the API tier we use applies to inference-time storage.
In our logs
Application logs contain routing metadata (timestamps, response times, error codes) but not message contents. Retained 90 days for security audit.
The absence list.
- ○No client-side tracking beacons. No Google Analytics. No Mixpanel. No Segment. No Meta pixel.
- ○No third-party scripts on chat pages other than Stripe's checkout iframe when you're actively subscribing.
- ○No employee has read-access to individual chat contents. Admin tooling shows account state (subscription, meal ledger) but not messages.
- ○No shared secrets in code — everything sensitive is in a secrets manager, not a .env checked into a repo.
- ○No unencrypted database backups — full stop.
One address. One-day acknowledgment.
Email privacy@ladle.chat with the details. PGP available at ladle.chat/pgp for sensitive reports. Acknowledged within 1 business day; critical (active exploitation) escalated immediately if you mark the subject [URGENT-SECURITY]. We don’t run a paid bounty; we run a coordinated-disclosure process with public acknowledgment on request.
Specifics on this page. More on /trust.
If something isn't answered, email us — one real person, one day.