Your website and data security isn't an afterthought — it's built into how the platform works. Here's what's true today, in plain terms.
While your project is with us, your website runs on infrastructure dedicated to it — its own GitHub repository and its own Vercel deployment — and it transfers to you at handoff. Your site is a standard Next.js app, so nothing is locked to us: your code and data are portable, and if you ever leave, you keep everything. For most owners that's a stronger guarantee than any certificate.
You sign in with your email and password. Authentication runs on Supabase Auth: passwords are salted and hashed, never stored in plain text, and never visible to us. You can reset your password by email at any time.
Every client's data is protected by Supabase Row-Level Security, enforced at the database layer — not just in the app. One client can never read another client's projects, conversations, or credentials.
Service tokens and access keys are stored encrypted at rest and used only on the server. They are never returned to your browser.
Sessions use secure, server-side cookies — not browser localStorage — so your login can't be lifted from the page.
Connector credentials are held in Anthropic's managed-agent infrastructure and provided to the AI per session, rather than sitting on our servers.
When you grant database access, the AI can read your schema to write correct code — it never writes to your live database directly. Schema changes are saved as migration files and applied only when you publish.
No AI change reaches production without your approval. Every change is built as a Vercel preview you review, and nothing ships until you click Publish. Everything is version-controlled and revertable.
Each session is scoped to exactly one project's repository. The AI working on your site can't reach into anyone else's.
Mission Control is built on SOC 2-compliant infrastructure — Supabase, Vercel, Stripe, and Anthropic. The platform itself is early and not separately SOC 2 certified; we'd rather tell you exactly how it works than wave a badge. Because your code and data live in accounts you own, you're never dependent on our certification to keep control of them.
Questions about security? hello@weblaunchacademy.com
