Security & responsible use.

Controls implemented in this app

• ChatGPT sign-in identifies accounts; stored records and file routes check ownership server-side.
• Administrative actions check permissions. Authorised support staff can review requests, reply and update their status. Private owner notes, staff assignment, legal configuration and spending controls remain owner-only.
• Changing requests check their origin; form lengths, request keys and support rate limits are checked on the server.
• API credentials stay on the backend. Build output is scanned for the configured API key before publication.
• AI calls require approved scope and atomic budget reservations. Live payment collection remains disabled.
• Private API responses use no-store caching directives. PDF exports require the report owner’s sign-in.

Limits of these statements

These are application controls, not a security certification. No independent penetration test, end-to-end encryption, invulnerability or guaranteed incident response is claimed. Hosted providers also process data. Encrypted same-host snapshots, stale-heartbeat checks, stalled-debate checks and isolated hosted recovery rehearsals are implemented. Independent off-site backup, external outage alerting, production cutover and account-specific provider assurances still require operational proof.

Report a vulnerability responsibly

Choose Security concern in Help & requests. Describe the affected page, minimal reproduction steps and impact. Do not access another person’s data, disrupt service, publish secrets or continue testing beyond what is necessary to explain the issue. This is not a bug-bounty programme or permission for intrusive testing. An external security contact is not yet configured.

Protect your own workspace

Use the security options offered by your sign-in provider. Sign out on shared devices. Keep private information out of unnecessary uploads and remove secrets from screenshots or pasted error messages. If you suspect account compromise, secure your sign-in account and report the concern.