Boring, verifiable security practices.

Vercel hosts this website. Convex stores application records and portal files. Clerk handles accounts and sign-in, and Stripe processes payments. Each provider handles a different part of the service.

Vercel, our website host, documents HTTPS encryption for connections to its sites. HTTPS protects information while it travels between your browser and the site. Convex, our database provider, says user data is encrypted at rest, meaning while stored.

Other integrations depend on the feature:

For OpenAI conversion events, contact identifiers are hashed before sending, which changes their format but does not make them anonymous. See our privacy policy for information collected through the site and your choices.

Staff sign in to all of our platforms with two-factor authentication, which asks for a second proof, such as a code, after the password. CSS staff access is controlled by roles and module permissions, checked on the server. Owner and administrator roles have broader access than roles limited to sales, marketing or delivery work. The admin page requires sign-in, and backend admin functions use the portal permission check.

Our CRM, the staff system for customer records, records field changes to accounts, contacts, opportunities and tasks through its audited write functions. Those records include the changed fields, time and signed-in actor when available. This is a change history, not a claim that every view of client information is logged.

The signed-in client portal links engagements to a Clerk account. Its engagement access check compares the signed-in user with the account linked to that engagement before allowing client messages and notebook access.

Onboarding also uses private engagement links. Treat those links as sensitive and do not forward them to people who should not have access.

Card entry uses Stripe Checkout. CSS stores Stripe references and payment details such as status, card brand and last four digits, rather than full card numbers. The Stripe webhook, which receives payment event notifications, rejects events with a missing or invalid signature.

Clerk handles sign-in and sessions. Keep your sign-in credentials private and contact us if you think an account or private link has been exposed.

Use public forms and chats for general questions, not confidential client records, regulated information or payment details.

Anthropic says its commercial API inputs and outputs are not used for model training by default. Its stated exceptions include feedback and an explicit choice to share data. We use Google's paid Gemini service, and Google's Gemini API terms say paid-service prompts and responses are not used to improve its products. Do not assume one provider's policy applies to every AI feature.

For software we build for clients, the AI Operations Services Agreement addresses ownership and confidentiality.

• Section 11. Your accounts and data belong to you from the start. Ownership of the custom application transfers when the work is complete and paid for. CSS keeps its pre-existing tools and libraries, with a perpetual, royalty-free, non-exclusive license for those included in your application for your own business. You may hire CSS to manage or extend the application after transfer, but are not required to.
• Section 15. Both parties protect the other's non-public information and use it only to deliver or receive the services.
• Section 13. Clients provide needed access and report issues through the portal.
• Section 5. Care-plan hosting and upkeep; those terms apply to the service you buy, not every visitor to this site.

Your signed agreement controls, as our website terms explain. Put any specific security requirements and handover arrangements in the written scope before work starts.

This website's repository includes automated tests for portal access, CRM permissions and payment behavior, plus lint and production-build commands. Payment-plan code distinguishes Stripe test and live keys and rejects a key that does not match the selected mode.

These are specific checks, not evidence of an independent security audit or a policy for every application CSS builds.

If a security incident affects your information, we usually tell you within the same week. Your signed agreement and scope can set a firmer timeline if your business needs one.

Our privacy policy lets you ask what information we hold about you, request corrections or request deletion through contact us. It says we act on verified requests. For engagement notices, section 21 of the agreement provides the portal's messages or written contact with Anthony Smith.

We usually keep information for about three years unless otherwise noted, for example in your signed agreement, then delete or de-identify it.

Do not send passwords, full payment details or confidential records with an initial request.