Security
Last updated: 15 July 2026
Security at Euredas starts with a simple idea: the less we collect, and the less that can go wrong, the safer you are. This page explains how the marketing website atwww.euredas.ai (the “Site”) is built, how we protect the one thing you can give us here — your waitlist entry — and how to reach us if you find a vulnerability. It covers this marketing Site only; the Euredas product application is a separate service with its own security practices.
1. Our approach to security
Three principles shape how this Site is designed and run:
- Collect the minimum — the Site asks for nothing except what you choose to type into the waitlist form, and loads no analytics until you opt in.
- Grant the minimum — every credential the Site uses has the least power it can have; the public key the Site ships cannot read or change waitlist data, and signups travel through a server gate whose only power is adding one entry.
- Keep the surface small — a static website with no server, no accounts and no sign-in has far fewer places for things to go wrong.
No method of transmission or storage is completely secure, so while we work hard to protect your data we cannot guarantee absolute security.
2. How this Site is built
- The Site is fully static — pre-built pages served from a global edge network, with no server runtime, no session state and no database credentials capable of reading data.
- There are no accounts and no sign-in on the Site — authentication lives entirely in the separate product application, so no passwords ever pass through these pages.
- All traffic is encrypted in transit (HTTPS/TLS).
- Every release is an immutable, atomic deployment that can be rolled back instantly.
- Fonts are self-hosted, and no third-party analytics scripts load until you opt in via the cookie banner.
3. How we protect waitlist data
The waitlist form is the only place on the Site where you can give us personal data. Here is how that data is protected:
- Entries are stored with Supabase in the Mumbai (India) region, in a dedicated project kept separate from the Euredas product.
- Signups pass through a server-side gate: a Cloudflare Turnstile bot check (invisible to most humans) is verified on our server, and submissions arerate-limited per network address, before anything is written.
- The browser itself cannot touch the database: strict row-level security and revoked privileges mean the public key the website ships can neither write entries nor ever read entries back, so leads cannot be listed or leaked from the Site.
- The database enforces its own validation — format and length constraints and case-insensitive de-duplication hold even against requests that bypass the form.
- An invisible honeypot field traps bots; flagged submissions are discarded, not stored.
- Confirmation emails are sent entirely server-side — no email credential ever reaches the browser, delivery events from our email provider are accepted only with a valid cryptographic signature, and anything you typed is escaped before it is used in an email.
4. What we deliberately don't do
- We set no cookies of our own — your cookie choice is stored in your browser's local storage and never leaves your device.
- No analytics until you opt in — Google Analytics runs cookieless and consent-denied by default, and Microsoft Clarity does not load at all until you accept analytics in the cookie banner.
- Where session replay runs (only after opt-in), on-screen text ismasked by default.
- We collect no passwords and no payment details anywhere on the Site.
- We do not sell personal data or share it for others' advertising.
5. Infrastructure & sub-processors
The Site runs on a small set of providers: Google Firebase (hosting),Supabase (the waitlist database, India),SendGrid (Twilio) (waitlist confirmation email delivery),Cloudflare (the Turnstile bot check on the waitlist form), and — only with your consent — Google and Microsoft (analytics). The canonical list of who processes what, and where, is the recipient table in ourPrivacy Policy.
6. Security in the Euredas product
The Euredas product application — where signed-in customers run campaigns — is a separate service with its own security controls and practices, and its own documentation will accompany it. For security questionnaires or enterprise security questions about the product, contact us atsecurity@euredas.ai.
7. Responsible disclosure
If you believe you have found a security vulnerability, please tell us privately —not through public channels such as social media or public issue trackers. Emailsecurity@euredas.ai with as much of the following as you can:
- a description of the issue and its potential impact;
- steps to reproduce it (proof-of-concept, affected URL, payloads);
- any suggested remediation, if known.
Our commitment
- We will acknowledge your report within 3 business days.
- We will complete an initial assessment and severity triage within10 business days.
- We will keep you updated on remediation, and credit you (if you wish) once a fix ships.
Safe harbor
We will not pursue or support legal action against researchers who act in good faith — that means avoiding privacy violations, data destruction and service degradation, and giving us a reasonable opportunity to remediate before any public disclosure. Thank you for practicing responsible disclosure.
Out of scope
- denial-of-service, volumetric or spam testing — including bulk submissions against the waitlist form;
- social engineering or phishing of our team;
- automated scanner output without a working proof of concept;
- best-practice observations without a demonstrated security impact (for example, a missing header with no exploit).
Reports about the separate Euredas product application are welcome at the same address — we will route them to the right team.
8. Changes to this page
We will update this page as the Site and our practices evolve, and revise the “Last updated” date above when we do.