Early-access draft — legal review pending. These pages are restored for transparency and review; they are not confirmation that the platform is commercially launch-ready. Paid checkout remains closed.
Security at CitedLoop
CitedLoop is designed to limit customer access to the correct workspace and keep publishing credentials out of public clients.
Controls
- Supabase row-level security isolates customer workspaces.
- Service-role credentials and provider secrets remain in server-side secret storage.
- Publishing credentials are encrypted at rest and decrypted only inside authorised publishing functions.
- API-key endpoints validate their own credentials; Stripe webhooks verify signatures.
- Usage quotas, rate limiting, key rotation and job retries reduce abuse and operational failures.
- Raw measurement trials are retained to make confidence calculations auditable.
Responsible disclosure
Email sales@citedloop.com with the affected surface, reproduction steps and impact. Do not access other customers’ data or disrupt production. We will acknowledge valid reports and coordinate remediation.
Customer guidance
Use least-privilege platform tokens, rotate credentials after team changes, review generated fixes before publishing and remove integrations you no longer use.