Security

Honest account of how FeedGuard protects your data — written for buyers, not auditors.

API authentication: every non-public API endpoint requires a per-account API key (X-API-Key or Authorization: Bearer). Keys are stored only as SHA-256 hashes; cross-account reads are rejected.
Secrets management: every credential and key is configured via environment variables — nothing is hardcoded, and sample configs ship without real values.
Transport: the service is designed to run behind TLS; we terminate HTTPS at the reverse proxy and never accept credentials over plain HTTP in production.
Payments: checkout and card handling are done by Stripe; card numbers never touch our servers.
Input validation: every endpoint validates and bounds its inputs (feed size, plan product limits, parse errors); malformed requests get a 400, never a stack trace.
Logging: structured logs for operations and security events; no secrets or keys are written to logs.

We are not SOC 2 certified and have not completed a third-party penetration test. We'll say so plainly until we have.
Single-node JSON data store in v1 — back it up daily. A database migration is the scale path.

Email don+feedguard@lifeofmorr.com with details. We aim to acknowledge within 2 business days.