Security approach

AlignBusiness is designed with layered safeguards across account access, application infrastructure, data handling, payments, AI processing, and connected services. Security practices continue to evolve as the product, infrastructure, and threat environment change.

This page describes the safeguards we currently design and operate around the service. It is not a representation that AlignBusiness has obtained a particular certification, audit, or regulatory designation unless that status is expressly stated elsewhere in writing.

Account protection

• Authentication is required for protected account and workspace areas.
• Access controls are used to separate public pages, customer workspaces, paid capabilities, and administrative functions.
• Server-side authorization checks are used for protected operations where appropriate rather than relying only on what is hidden in the browser interface.
• Users are responsible for protecting passwords, email accounts, devices, and recovery methods used to access AlignBusiness.

Infrastructure and data in transit

AlignBusiness is hosted on modern cloud infrastructure and is designed to use HTTPS/TLS encryption for information transmitted between supported browsers and the service. Hosting, database, and infrastructure providers maintain additional platform-level safeguards under their own security programs.

Our current application architecture uses Vercel for hosting and delivery and Supabase for authentication, database, and related backend functionality. Provider configurations and services may change as the platform evolves.

Payments and card data

Subscription checkout and billing management are handled through Stripe. Standard card details are entered on Stripe-hosted or Stripe-controlled payment interfaces, so AlignBusiness does not need to store full payment-card numbers on its own application servers for normal subscription billing.

Payment processors maintain their own security and compliance programs. AlignBusiness does not represent that its own application environment is independently certified under a payment-card standard merely because a payment processor is used.

AI processing

Certain AlignBusiness features send the information needed for a request to an AI service provider. Our current AI-assisted workflows use the OpenAI API. We limit AI requests to the context needed to perform the feature where reasonably practical, but users should avoid placing unnecessary highly sensitive information into general-purpose prompts.

Transactional email

AlignBusiness uses an email delivery provider for messages such as password resets, account notices, billing communications, and other transactional email. Our current implementation uses Resend for supported transactional email workflows.

Secrets and privileged credentials

• Private API keys and service credentials are intended to be stored in protected server-side environment configuration rather than exposed in public client code.
• Service-role credentials and other privileged secrets should only be used by trusted server-side functions that require them.
• Users should never paste passwords, full payment-card numbers, private API keys, or government account credentials into ordinary prompts or general text fields.

Connected services and permissions

When integrations are available, access should be limited to the permissions authorized for that connection and needed for the requested functionality. Users should review requested permissions before connecting an external account and revoke access when the integration is no longer needed.

A displayed third-party brand or suggested integration does not automatically mean a live account connection exists or that the provider has endorsed AlignBusiness.

Application and operational safeguards

• Protected server-side operations are separated from public client code where appropriate.
• Administrative functions are intended to be restricted to authorized users and roles.
• Logging and diagnostic information may be used to identify failures, investigate suspicious activity, and improve reliability. Sensitive credentials are not intended to be included in customer-facing errors or routine diagnostic output.
• Billing webhooks and other server-to-server events should be validated before account access or subscription state is changed.
• Dependencies, platform services, and application controls may be updated as security fixes and product improvements become available.
• Customer-facing database access is protected with row-level access controls, while privileged integration credentials and operational records are kept out of direct customer access.

Your role in security

• Use a strong, unique password and protect the email account tied to AlignBusiness.
• Do not share login credentials or API keys with unauthorized users.
• Review third-party permissions before connecting software or financial accounts.
• Do not submit confidential or regulated information unless it is necessary, you are authorized to provide it, and the feature is appropriate for that information.
• Sign out of shared devices and contact support promptly if you believe your account or data may have been compromised.

Security incidents

If we confirm a security incident affecting user information, we will investigate, take appropriate containment and remediation steps, preserve relevant records where appropriate, and provide notifications when required by applicable law or contractual commitments.

Compliance scope

Unless AlignBusiness expressly agrees otherwise in writing, the service should not be assumed to satisfy specialized requirements such as HIPAA, GLBA, PCI DSS merchant certification, SOC 2 certification, FedRAMP, or industry-specific recordkeeping obligations. Organizations with regulated-data requirements should confirm suitability before submitting that data.

Report a security concern

If you believe you found a vulnerability or security issue, report it to support@alignedu.net with enough detail for us to investigate. Please do not access, alter, retain, or download data that is not yours while testing a potential issue, and do not disrupt the service.