Encryption
- In transit: all traffic between your browser and the service is encrypted with TLS (HTTPS).
- At rest: stored data is encrypted at rest by our hosting provider.
- Passwords are stored only as cryptographic hashes by the authentication layer — we never see or store a plaintext password.
Access controls — the part most tools can’t say
- All plan-intelligence data is served through a server-side gateway. The browser never holds a credential that can read the dataset directly; every request is authenticated, authorized, and rate-limited on our servers.
- Database tables are protected by row-level security with deny-by-default rules; sensitive tables are readable only by server-side roles.
- Access is tiered and enforced server-side — data you’re not entitled to, down to the identity fields of a single row, never leaves the server, rather than being hidden in the browser.
- Per-user usage budgets, rate limits, and automated abuse detection guard against scraping and bulk extraction.
Account protection
- Two-factor authentication (2FA) is available on every account — add a second step at sign-in with an authenticator app.
- Bot and abuse protection on every sign-up and sign-in (Cloudflare Turnstile).
- Passwords are checked against known breach databases; weak or compromised passwords are rejected.
- Email confirmation is required to activate an account.
- Internal access to production systems is limited to authorized personnel and protected by strong authentication.
Payments
- Payments are handled entirely by Stripe, a PCI-DSS-certified payment processor.
- We never store full payment-card numbers — card data never touches our servers.
Artificial intelligence
- We use a third-party AI provider to help turn public filing documents into structured data.
- Only public filing content is sent — never your personal information, account data, or usage data.
- Under the provider’s API terms, submitted content is not used to train its models. Output is verified and stored like any other filing-derived data.
The data we show
- Computed from public regulatory filings — the U.S. DOL Form 5500 series and SEC/state investment-adviser filings, published by government agencies.
- We compile, verify, compute, and present; we don’t represent that the underlying public filings are complete or error-free.
- 100bps is a business-to-business prospecting tool — not a consumer-reporting agency, and not for consumer credit, employment, insurance, or eligibility decisions.
Where your data lives
- 100bps runs on managed infrastructure: the database and authentication on Supabase (PostgreSQL, hosted on AWS), the application on Vercel, and this marketing site on Netlify.
- Account data, saved playbooks, and pipeline entries live in the managed database with automated backups.
- Each service provider receives only what it needs for its function — see the Privacy Policy for the full list.
Data retention and your control
- We keep data while your account is active, and afterward only as long as needed for legal and operational purposes — see the Privacy Policy, including how to request deletion.
- Use a strong, unique password and keep your credentials private — your license is per-firm, and credential sharing is both a terms violation and a risk to your own client work.
- Tell us immediately if you suspect unauthorized access to your account.
We list only what’s true today. We don’t claim SOC 2 certification or formal incident-response
SLAs we haven’t yet earned — this page grows only as the reality does.
Responsible disclosure. If you believe you’ve found a security vulnerability, email
security@100bps.ai with details. We’ll
acknowledge your report, work to address valid issues promptly, and ask for a reasonable opportunity to
remediate before public disclosure.