Security at Resonate

Data Protection

• All data encrypted in transit (TLS/HTTPS) and at rest.
• Row-level security ensures each user can only access their own data.
• API keys and secrets stored server-side only - never in client code.

Authentication

• Secure token-based authentication managed by Base44 platform.
• No passwords stored - authentication handled via secure OAuth flows.

API Security

• All backend functions validate user identity before processing requests.
• Error responses are sanitized - no internal details, stack traces, or system information exposed.
• Stripe webhooks verified via cryptographic signature validation.
• Admin-only operations require role verification.

Third-Party Integrations

• OAuth-based connections with minimal permission scopes.
• Users can disconnect any integration at any time.
• Access tokens are never stored in the frontend.

Compliance

• GDPR-compliant data export and deletion tools available to all users.
• Privacy Policy and Terms of Service available at /privacy and /terms.

Infrastructure

• Hosted on Base44's managed cloud platform with enterprise-grade security.
• Automated deployments with no manual server access required.

Responsible Disclosure

If you discover a security vulnerability, please contact tom@getresonate.ai.