Security

Every table that stores research content carries row-level security policies tied to the signed-in account. Queries are evaluated by the database, not by the browser, so a modified client cannot read another researcher's rows. Privileged operations run only in server code after the caller's identity has been verified.

Our staff do not browse your research content. If a support request cannot be resolved any other way, you can grant time-limited support access from Settings, giving a reason and a duration of up to seven days. Access expires by itself, you can withdraw it at any moment, and every action taken under it is written to your access history and activity log.

All traffic uses TLS. Data at rest is encrypted by the managed database and object store. Uploaded files live in a private bucket that is never publicly listable; downloads happen through short-lived signed URLs issued to the file's owner.

User data may be processed and stored in the United States and, where necessary to provide the service, in other jurisdictions where our authorized infrastructure, hosting, payment, authentication, analytics, or service providers operate. We require service providers to handle personal data in accordance with applicable privacy and data protection laws and appropriate contractual safeguards.

Sign-in uses a managed authentication service with hashed credentials, email verification and password reset. Google sign-in is available. Sessions are refreshed with rotating tokens and can be ended by signing out on any device.

Card data never touches our servers. Checkout is hosted by our payment processor, and subscription state is only written after webhook signatures are cryptographically verified. Every payment event is recorded once, so a replayed webhook cannot change your plan.

Model calls are made server-side only. API credentials are held as server secrets and are never exposed to the browser. A request carries the app’s system and task instructions, the project context you selected, up to the last eight messages of the conversation and your question; your account identity is not sent with it. Operational records of every request are always kept, request content may be retained for up to 90 days where gateway debugging visibility is enabled, and the model provider documents its own abuse-monitoring retention — see the research data statement.

External AI agents can connect through our agent integration only after you approve an explicit consent screen. The agent then acts as you, under the same row-level rules, and you can revoke access at any time.

Identifiable participant data, restricted data, ePHI/HIPAA-regulated data, education records requiring institutional approval, and other regulated or institutionally controlled data are not supported here. Use an institution-approved system and follow your IRB or data-management plan for that material — de-identified research documentation is the supported use case, and de-identifying a file does not by itself make restricted data acceptable to store here.

If you believe you have found a security issue, email share@perspectivesplus.org with steps to reproduce. Please give us a reasonable window to fix the issue before disclosing it publicly, and avoid accessing other people's data while testing. We will acknowledge your report within five working days.