Security

Agnotiq MarginTide Price Checkeris a multi-tenant service: every customer’s catalog, pricing runs, and recommendations live in an isolated workspace. The sections below cover how we keep workspaces separate, how you sign in, how data is protected in transit and at rest, how our own support staff can (and cannot) access your workspace, how you can audit what happened in your account, the operational guardrails around cost and automation, our most recent security testing, how to report a vulnerability, and where your data is hosted.

Workspace-scoped data is protected by Postgres row-level security (RLS) enforced at the database itself — every query is filtered to the caller’s own workspace at the data layer, not only by application logic. The application layer adds a second, defense-in-depth check on top of RLS, re-validating workspace membership before serving or changing workspace data. Two independent layers have to agree before cross-workspace data is ever returned.

Sign-in is passwordless: you receive either a magic link or a 6-digit one-time code by email. We do not store account passwords, so there is no password database to breach. Sign-in and code-verification attempts are protected by IP-based velocity throttling, which slows down automated guessing/abuse attempts.

• In transit. All traffic to and from the Service is encrypted using TLS.
• At rest. Data at rest is protected with 256-bit encryption by our infrastructure providers (Supabase for the database, Vercel for application hosting).
• Payments. Payments secured by Stripe. No card data stored on our servers.

Our own support and platform staff cannot browse into your workspace unnoticed. Every support-access session is consent-gated: either a platform admin requests access and a workspace owner or admin must approve it with a one-time code, or your workspace proactively requests support yourself, which itself counts as consent — there is no code path that grants access without a recorded grant.

Every granted session is time-boxed to the approved duration (15 minutes up to 8 hours) and read-only— mutating requests are blocked centrally for the duration of the session, and a persistent, non-dismissible banner is shown on every page while a session is active, with a one-click exit. Every step of the lifecycle — requested, granted (or declined), started, and stopped — is written to your workspace’s audit log.

Every workspace keeps an append-only audit log covering configuration changes, billing events, member and role changes, recommendation and alert state changes, and support-access events. Entries are never edited or deleted by design. Workspace owners and admins can export the full audit log as a CSV file at any time from Settings → Audit.

• Plan caps & cost ceilings.Every research run is checked against your plan’s limits — research units, catalog size, retailers, schedules, and team members — before any work starts, so a workspace can never be silently over-run. Individual agent sessions also carry their own per-run cost ceiling.
• Webhook integrity. Inbound webhooks (from our payment processor, our AI provider, and Slack) are cryptographically signature-verified before we act on them.
• Idempotent processing. Re-delivery of the same webhook or scheduled event is handled idempotently — it is recognized and skipped rather than applied a second time.

If you believe you have found a security vulnerability in the Service, please report it responsibly rather than exploiting or publicly disclosing it. Our disclosure contact and policy are published at /.well-known/security.txt (RFC 9116), or you can email privacy@agnotiq.com directly. We will acknowledge reports and work with you on remediation and responsible timing before any public disclosure.

The Service and its data are hosted in the United States today, through our infrastructure providers’ US region (Supabase and Vercel both run our production stack in AWS us-east-1). We do not currently offer a choice of hosting region. Per-region data residency is on our product roadmap; it is not available today.