Security

Fastlook runs on established cloud providers.

• The web app runs on Vercel and the API on Render.
• Data lives in Supabase (Postgres) with row-level security.
• Traffic is served over HTTPS.
• Secrets (API keys, database credentials) are stored as environment variables in each provider — never committed to source control.

Every website Fastlook reads (to build Brand Memory or analyze a competitor) goes through an SSRF-guarded fetch.

• Internal/private addresses and cloud metadata endpoints are blocked.
• Redirects are followed only to safe hosts.
• Response size and time are capped.
• We read public pages only — we never access your CMS or publish anything without your approval.

Workspace access is authenticated, and the product is built for per-workspace tenant isolation. Server-side secrets are never exposed to the browser. As we move from open beta to production, we enforce authentication on every non-public route.

• We use your data to operate the product for you — grounding content, capturing leads, and reporting results.
• We do not sell your data.
• Generated content is grounded in your Brand Memory; we don't fabricate claims on your behalf.
• Third-party processors we rely on are listed in our privacy policy.

Found a vulnerability? Please report it privately via our contact formbefore disclosing publicly, and we'll work with you to fix it quickly. As we scale, we'll formalize our security program (including third-party review); we'll describe it here honestly as it matures rather than claim certifications we don't yet hold.