Legal
Security
A customer-facing overview of how VisibleMax approaches security for our AI visibility platform — infrastructure, access control, and how to report issues.
Effective date: August 6, 2026
Last updated: August 6, 2026
These pages are provided for transparency and operational clarity. They are not legal advice. VisibleMax is not yet legally incorporated; entity name, registered address, and governing law must be updated after incorporation and reviewed by qualified counsel before relying on these policies for commercial launch, regulatory filings, or customer contracts.
1. Our commitment
VisibleMax handles account data, website scan results, and project content that customers trust us to process carefully. We design the product with defense-in-depth principles: least privilege, encrypted transport, isolation between customer accounts and projects, and responsible vulnerability handling.
VisibleMax is the product operating name and is not yet legally incorporated. After incorporation, this page will be updated with the registered entity name and address. Placeholder: [PLACEHOLDER — update after incorporation: registered legal entity name, registered address, and governing law / venue].
This page is an overview for customers and prospects. It is not a formal audit report, penetration-test certificate, or compliance attestation.
2. What we do not claim
VisibleMax does not claim SOC 2, ISO 27001, FedRAMP, or similar third-party certifications. If and when we complete such programs, we will update our public materials accordingly. Please do not infer certification from marketing language alone.
At launch we also do not offer Enterprise security addenda, team / multi-seat collaboration, MCP integrations, or a Chrome extension. Security practices described here apply to the shipped Free and Pro Early Adopter product.
3. Infrastructure
- Application hosting: VisibleMax is hosted on Vercel, which provides globally distributed application delivery and serverless compute.
- Data and authentication: We use Supabase for authentication and primary application data storage. Essential session cookies are described in our Cookie Policy.
- Background jobs: Long-running workflows (scans, analyses, billing-related jobs) may run via Trigger.dev when configured.
- Metering / rate limits: Upstash Redis may be used for ephemeral counters and rate limiting when configured.
- Payments: Card data is handled by Polar (merchant of record / payment processor). We do not store full payment card numbers on VisibleMax application servers.
- Optional analytics: PostHog may run only when consented via the cookie banner.
4. Authentication and access control
- User authentication is provided through Supabase Auth (email/password and/or supported OAuth flows depending on configuration).
- Session cookies are used to maintain authenticated access; see our Cookie Policy.
- Application data access is scoped to your account and projects. The launch product does not include team invites or multi-seat collaboration — protect your login credentials accordingly.
- Administrative access to production systems is limited to authorized personnel with a need to know.
5. Encryption
- In transit: Public VisibleMax traffic is served over HTTPS/TLS.
- At rest: Data stored with our infrastructure providers is protected using the encryption capabilities those providers offer for their managed services. Specific key management details may vary by provider and plan.
6. Application security practices
We apply pragmatic controls appropriate to our stage, including:
- Input validation and server-side authorization checks on sensitive actions
- Protections against common web risks (for example injection and cross-account data leakage) as part of ongoing engineering
- Crawl-time safeguards intended to reduce SSRF and unsafe fetch targets for user-supplied URLs
- Rate limiting and abuse controls where configured
- Dependency and platform updates on a regular engineering cadence
No software is risk-free. We continuously improve controls as the product matures.
7. AI providers and customer data
Scan analysis and probing may use third-party AI providers: OpenAI (ChatGPT), Anthropic (Claude), Google (Gemini), Perplexity, xAI (Grok), DeepSeek. Customer data is not used to train AI models. See AI Transparency and the Privacy Policy.
8. Subprocessors (summary)
Customer data may be processed by providers that help us operate the Service, including:
- Vercel — hosting and edge delivery
- Supabase — auth and database
- Polar — billing, trials, and payments
- AI model providers (OpenAI (ChatGPT), Anthropic (Claude), Google (Gemini), Perplexity, xAI (Grok), DeepSeek) — analysis and probes
- Trigger.dev — job orchestration
- Resend or similar — transactional email when enabled
- Upstash — Redis metering / rate limits when enabled
- PostHog — optional analytics when consented
9. Incident response (high level)
If we become aware of a security incident that affects customer personal data, we investigate, contain, remediate, and — where legally required — notify affected customers and regulators within applicable timelines. Monitor the email address on your account for notices.
To report a suspected incident involving your account, contact [email protected] and [email protected].
10. Vulnerability reporting
If you discover a security vulnerability in VisibleMax, please report it responsibly:
- Email [email protected] with reproduction steps, impact assessment, and any proof of concept
- Review program scope and expectations on our Bug bounty page
- Allow us a reasonable time to investigate and remediate before public disclosure
- Do not access data that is not yours, and do not degrade the Service for other users
11. Customer shared responsibility
- Use strong unique passwords and protect account credentials
- Only submit URLs and content you are authorized to have scanned
- Avoid placing secrets in scanned pages, prompts, or support tickets unless necessary
- Review generated assets before publishing them to production sites
- Cancel Pro trials in time if you do not want to be charged (see Refund Policy)
12. Questions
Security: [email protected]
General support: [email protected]