Your site data does not leave your browser unless you ask it to

The free screening makes no request

The engine is plain TypeScript with no dependencies and no network code. The screening tool imports it and runs it in your browser tab. When you press the button, nothing leaves the page.

This is worth stating precisely because it is an architectural fact rather than a policy. There is no endpoint behind the free screening to be misconfigured, no log to be retained past its schedule and no third party to have a breach on our behalf. The location, acreage and dates of your site have nowhere to go.

It stops being true the moment you sign in and save a site, which is the point of a paid plan: the permit requires a retained record, and a record has to be stored somewhere. Everything below describes that side.

What we store when you have an account

The sites you save, the determinations attached to them, the plan documents generated from them, the inspection and corrective action entries you record, your account email, and a log of API requests made with your keys.

We do not want anything else. There is no reason for this product to hold your financial records, your personnel data or your customers' details, and it asks for none of them.

Access control

Data is isolated per account at the database layer with row level security, so a query that forgets to filter by account returns nothing rather than returning somebody else's site. Authentication is handled by Supabase with tokens rather than passwords in our own code.

API keys are stored as hashes. We cannot show you a key again after it is created, which is inconvenient exactly once and safe permanently. A key can be revoked from the account page and stops working immediately.

Payments

Card details are handled by Stripe and never reach our servers. We store a customer identifier and a subscription status, which is all that is needed to decide what your plan grants.

Transport and hosting

Everything is served over HTTPS. The application runs on Vercel and the database is Supabase managed Postgres. Neither of those is a security claim by itself, which is why they are stated as facts about the stack rather than as reassurance.

What we have not done

We hold no third party security certification. There is no SOC 2 report, no ISO 27001 certificate and no completed penetration test to send you. If your procurement process requires one, we do not currently meet it, and you should know that before you evaluate us rather than at the end.

We are a small product early in its life. The controls above are real and the absences above are real, and we would rather list both than describe a security posture we have not earned.

Reporting a vulnerability

Email support@basinwise.com with enough detail to reproduce it. We will confirm receipt, fix what is real, and tell you what we did. We do not run a paid bounty programme, and we will not threaten anybody who reports a problem in good faith.