Security
Security at UncoveredList
A plain description of how the service is built and protected today. We only list what is actually in place.
Last updated
- Hosting and encryption in transit
- The site and our daily data job run on Vercel. Every page and API is served over HTTPS, and the site sends an HTTP Strict Transport Security header (2-year max-age, including subdomains) so browsers only connect over HTTPS. We also send standard browser security headers: no framing of our pages (clickjacking protection), no MIME-type sniffing, a strict referrer policy, and camera, microphone and location access turned off.
- Database and access control
- Account data and leads are stored in a managed Supabase (PostgreSQL) database. Row-level security is enabled on every table: a signed-in user can read only their own account's settings, tracking and saved searches, and only leads for the states on their plan. Internal tables (contact messages, payment events, job logs) have no browser access at all. The privileged database key is used only on our servers and is never sent to the browser. Secrets are kept in our hosting provider's environment settings, not in code.
- Sign-in
- Accounts use Supabase Auth with email confirmation. Passwords are handled by Supabase's authentication service; we never see or store them in plain text. (New accounts open at launch.)
- Payments
- We don't take payments yet. When billing opens, checkout and the billing portal are hosted by Stripe. Card numbers go directly to Stripe and are never stored on our systems; we keep only the card brand, last four digits and billing status, as described in our Privacy Policy.
- What data we hold
- Leads are business-level public records from official state open-data portals (see Data sources). We deliberately don't collect officer, owner, member, filer or individual registered-agent names, and we hold no consumer financial or health data. Customer data is limited to what an account needs: email, plan and preferences, territories, and lead tracking notes.
- Analytics
- We use Vercel Web Analytics and Speed Insights to count visits and page performance. Vercel describes Web Analytics as cookie-free; we don't run advertising trackers.
- Service providers
- We share data only with providers that run the service: Vercel (hosting), Supabase (database and sign-in), Stripe (payments, at launch), Resend (email delivery), Google Workspace (business email) and an AI model provider that receives business-level fields only (business name, entity type, city, industry code) to tag industries. The full list is in our Privacy Policy.
- Retention
- Retention periods are set out in our Privacy Policy, including how long account, billing and lead records are kept, and how to ask us to correct or suppress a record.
What we don't claim. UncoveredList is a small, early-stage company. We don't hold a SOC 2 report or ISO 27001 certification, and we don't run a paid bug bounty. If your agency needs a vendor security questionnaire completed, email us and we'll answer it accurately.
Report a security issue
If you believe you've found a vulnerability, email support@uncoveredlist.com with "Security report" in the subject and enough detail for us to reproduce it. Please don't access or change other people's data, run denial-of-service or automated high-volume tests, or publish the issue before we've had a reasonable chance to fix it. We'll acknowledge your report and keep you updated while we work on it.
Machine-readable contact: /.well-known/security.txt
Related: Methodology · Data sources · Privacy Policy · Terms