We're a small operation taking security seriously, not a Fortune 500 with a $5M security team. This page tells you exactly what we do, what we use, what we promise, and — importantly — what we don't claim. We'd rather be honest now than caught overstating later. Have a security question we don't answer here? Email beardedai.net@gmail.com.
1. Our security approach
XEROSPH3RE builds tools for service businesses. The data flowing through our systems includes business contact information, schedule details, pricing, financial records, and the content you entrust to the custom builds we deliver. We treat that data the way we'd want our own treated.
Our approach is built on five principles:
Less data is safer data. Lunara is local-first by design. The less we hold, the less can leak.
Stand on giants' shoulders. AWS, Stripe, Google, Supabase have spent billions on security infrastructure. We use them rather than reinvent.
Defense in depth. No single layer is the whole defense. HTTPS + hashed passwords + scoped tokens + PIN gates + WebAuthn — all together.
Honest about limits. We don't claim certifications we haven't earned.
Customer control. You can export your data anytime. You can delete your account. You're never locked in.
2. Certifications and what we don't claim
We believe in being upfront. Here's the truth about our certification status:
Certification / Standard
Status
Notes
SOC 2 Type II
Not yet
Roadmap target as we scale. Our infrastructure providers (AWS, Stripe) are SOC 2 Type II certified.
ISO 27001
Not yet
Same as SOC 2 — future target. Inheritance from infrastructure providers.
HIPAA
Not compliant
We do not sign Business Associate Agreements. Do not use XEROSPH3RE to store or process Protected Health Information (PHI). If you need HIPAA-grade tools, look elsewhere.
PCI DSS
By design
We never touch raw card numbers. Stripe handles all payment data and is PCI DSS Level 1 certified. Card details flow directly from your browser to Stripe, bypassing us entirely.
GDPR / UK GDPR
Aligned
Privacy Policy includes legal bases, data subject rights, breach notification commitments. Service providers operate under SCCs. Read more
CCPA / CPRA
Aligned
California rights documented and honored. We don't sell or share personal information for cross-context behavioral advertising.
COPPA
Aligned
Services are not directed at children under 13. We don't knowingly collect their data.
FedRAMP
Not certified
Not a federal contractor. Don't use XEROSPH3RE for classified or regulated federal data.
Why we publish this
Most SaaS companies claim every certification under the sun. We've all seen "SOC 2 compliant!" badges that turn out to be aspirational at best, deceptive at worst. We'd rather you know exactly where we stand. As we grow, we'll pursue the certifications that match our customer base — and we'll publish the actual audit reports here when we have them.
3. Encryption
Data in transit
All beardedai.net traffic uses HTTPS with TLS 1.2 or higher, enforced by AWS CloudFront
Modern cipher suites with forward secrecy
HSTS (HTTP Strict Transport Security) prevents downgrade attacks
Data at rest
Lunara local data: Stored in your browser's localStorage. Encryption at rest depends on your device (Mac FileVault, Windows BitLocker, mobile device encryption — typically on by default on modern devices).
Backend data (when Supabase is enabled): Encrypted at rest using AES-256 by Supabase's underlying Postgres infrastructure on AWS.
Payment data (Stripe): Stripe encrypts card data at rest using AES-256 and tokenizes for storage. We never see raw card numbers.
Static site files (AWS S3): Encrypted at rest with SSE-S3 by default.
Password storage
Current local-first version: passwords hashed with SHA-256 before localStorage write
Supabase migration (in progress): bcrypt with appropriate work factor — industry standard
We never log, transmit, or store plaintext passwords
4. Authentication
We support multiple authentication methods, layered for different threat models:
Token stored in your browser only — never sent to our servers
5. Data architecture
Local-first by design
The single most important security decision in Lunara: your business data stays on your device. Client lists, jobs, invoices, schedule events, and automation rules are written to your browser's localStorage. We literally cannot read them.
This architectural choice has significant security implications:
No central database to breach. Even if our servers were compromised tomorrow, your CRM data wouldn't be there to steal.
You control your data. Clear your browser, the data is gone — including from us.
Privacy law obligations are reduced. Data we don't have, we don't have to protect, disclose, or hand over to subpoenas.
We perform basic vendor due diligence: we don't use providers without published privacy and security policies, and we prefer providers with at least SOC 2 Type II certification for any service handling customer data.
7. Privacy compliance
Detailed privacy practices are in our Privacy Policy. Quick summary of compliance posture:
AlignedGDPR / UK GDPR — legal bases, data subject rights, 72-hour breach notification commitment, Standard Contractual Clauses for international transfers
AlignedCCPA / CPRA — full disclosures, right to know/delete/correct, GPC signal honored, no sale or sharing for advertising
AlignedCOPPA — Services not directed at children under 13
AlignedVCDPA, CPA, CTDPA, UCPA (Virginia, Colorado, Connecticut, Utah) — same data subject rights extended to those states
DisclosureGoogle API Services User Data Policy / Limited Use — explicitly documented in our Privacy Policy section 8
Data subject rights — how to exercise
Email beardedai.net@gmail.com with subject "Privacy Request" to request access, correction, deletion, portability, or opt-out. We acknowledge within 5 business days and substantively respond within 30 (extended to 45 days where law allows). Authorized agents may submit on your behalf with proof of authorization.
8. Access control
Customer accounts: Tenant data is namespaced — each tenant's data is stored under unique keys (crm_{tenantId}_*) and never accessible to other tenants.
Admin tools: Master admin PIN (2949) gates global infrastructure settings (Maps API key, Google OAuth Client ID, pricing). Limited admin PINs (8221, 4252) can manage tenants but cannot edit global config.
XEROSPH3RE staff: Currently a single operator (Jesse). All access is logged. As we scale, we'll publish a formal access policy.
Vendor access: Service providers (AWS, Stripe, Google) have access only to data they're processing on our behalf, governed by their respective DPAs.
9. Monitoring & logging
AWS CloudFront / S3 access logs — IP, user-agent, requested path, timestamp. Retained up to 90 days.
Stripe payment logs — billing events, payment failures, subscription changes. Retained per Stripe policy (typically 7+ years for financial records).
Application activity (Lunara) — actions like "client created," "email sent," "stage changed" are logged to your local activity feed (capped at 500 entries).
We don't deploy session-replay tools (FullStory, Hotjar, etc.) or third-party analytics that track individual users. We don't sell logs. We don't share logs with third parties except as required by law.
10. Incident response
Our commitment
If we discover a security incident affecting your data, we will notify you
For incidents affecting EU/UK residents: notification to supervisory authority within 72 hours per GDPR
For incidents affecting US residents: notification under applicable state law (typically "without unreasonable delay" or within statutory deadlines)
Notification will describe: nature of the incident, data involved, our response, and what you should do
Our process
Detect — alerted via vendor security feeds, customer reports, or internal monitoring
Include: description of the issue, steps to reproduce, potential impact, your contact info
What we'll do: Acknowledge receipt within 2 business days. Investigate and respond within 14 days with our assessment and remediation plan.
Please do not: publicly disclose before we've had a chance to fix, exploit the vulnerability beyond proof-of-concept, or access data that isn't yours.
Recognition: We don't have a formal bug bounty program yet, but we'll credit reporters publicly (with permission) and may offer service credit or other thanks for material findings.
14. Security roadmap
What we're working toward, in rough priority order:
Supabase backend migration — moves auth and payments off pure localStorage to industry-standard backend (in progress)
2FA / MFA enforcement — option to require WebAuthn or TOTP for tenant accounts
Stripe webhook signature verification — ensures only authentic Stripe events flip plan tiers
Row Level Security (RLS) policies — Supabase-side enforcement that tenants can only see their own data
SOC 2 Type II — first formal audit, target as we scale paying customer count
Bug bounty program — formal vulnerability disclosure program with rewards
Public uptime / status page — real-time service status visible to customers
HSM-backed key management — for any new sensitive operations we add
15. Contact
Questions, security inquiries, vendor due-diligence requests, or audit documentation requests: