Server-side API keys
AI provider credentials are stored in server-side environment configuration and are not intentionally exposed to browser code.
Security
Your data stays yours
Marketing Commander is built with security and privacy at every layer.
Secure sessions
Web sessions use secure cookie settings and server-side verification on protected requests.
Row-level security
Supabase row-level security is used on protected data paths to help scope access to the authenticated user.
Encrypted transport
All data in transit is encrypted via TLS. Infrastructure runs on trusted providers: Vercel, Supabase, Stripe, Upstash.
Approval-first publishing
Lumen prepares recommendations and drafts. Publishing and external actions remain behind explicit approval controls.
No client secrets
Sensitive credentials and service tokens are kept in server-side configuration rather than public client bundles.