Security & Trust
The people who use 100bps are professionals handling sensitive client relationships. This page explains, in plain terms, how we protect your account and your work. Security questions or concerns: access@100bps.ai.
Where your data lives
100bps runs on managed infrastructure: the database and authentication on Supabase (PostgreSQL), the application on Vercel, and this site on Netlify. Account data, saved playbooks, and pipeline entries live in the managed database with automated backups.
Encryption
- In transit: all traffic between your browser and the Service is encrypted with TLS (HTTPS).
- At rest: stored data is encrypted at rest by our hosting provider.
- Passwords are stored only as cryptographic hashes by the authentication layer — we never see or store a plaintext password.
Access controls — the part most tools can’t say
- All plan-intelligence data is served through a server-side gateway. The browser never holds a credential that can read the dataset directly; every request is authenticated, authorized, and rate-limited on our servers.
- Database tables are protected by row-level security with deny-by-default rules; sensitive tables are readable only by server-side roles.
- Access is tiered, and the tiers are enforced server-side: data a user is not entitled to — down to the identity fields of a single row — never leaves the server, rather than being hidden in the browser.
- Per-user usage budgets, rate limits, and automated abuse detection guard against scraping and bulk extraction.
- Internal access to production systems is limited to authorized personnel and protected by strong authentication.
Artificial intelligence
Your data never goes to an AI provider. Not anonymized, not encrypted — never sent. We use a third-party AI provider (Anthropic) for one narrow task: extracting structured data (such as fund lineups) from public filing attachments — government documents anyone can download. Your personal information, account data, and usage data are never part of that pipeline, so there is nothing for an AI model to retain. Under the provider’s API terms, submitted content is not used to train its models. Extraction output is verified and stored in our database like any other filing-derived data.
The data we show
The intelligence in the Service is computed from public regulatory filings (U.S. Department of Labor Form 5500 series and SEC/state investment-adviser filings), published by government agencies. We compile, verify, compute, and present; we do not represent that the underlying public filings are complete or error-free.
Payments
When paid subscriptions launch, payments will be handled entirely by a PCI-DSS-certified payment processor. We will never store full payment-card numbers.
Service providers
Each provider receives only what it needs for its function: Supabase (database/auth), Vercel (app hosting), Netlify (marketing site), Google Workspace (email), Sentry (error monitoring), Anthropic (extraction from public filings), Cloudflare Turnstile (bot protection, when enabled), and our payment processor once payments are live. Details: Privacy Policy.
Data retention
We keep data while your account is active and afterward only as long as needed for legal and operational purposes — see the Privacy Policy, including how to request deletion.
Responsible disclosure
If you believe you’ve found a security vulnerability, email access@100bps.ai with details. We will acknowledge your report and work to address valid issues promptly. Please give us a reasonable opportunity to remediate before public disclosure.
What we ask of you
- Use a strong, unique password and keep your credentials private — your license is per-firm, and credential sharing is both a terms violation and a risk to your own client work.
- Tell us immediately if you suspect unauthorized access to your account.