DATA & SECURITY
Your research, with clear boundaries.
Private account copies
Account research is restricted to its owner through authenticated requests and database row policies. Private API responses are marked no-store. Do not put passport numbers, bank details, identity documents or payment credentials in research notes.
Browser copies
Shortlists and draft research can remain in this browser profile. Anyone using that profile may see them. Use your own device, export only to a trusted location, and remove local copies before sharing a device. Signing out does not erase browser drafts.
Protection in the application
State-changing requests check their origin. Request bodies and research fields have size limits. Evidence links require HTTPS without embedded credentials. CSV exports neutralize spreadsheet formulas. Security headers restrict framing, browser capabilities and insecure mixed content.
What remains to be verified
This pilot has not completed an independent penetration test or a full account recovery and payment audit. Payments are not active. Source observations are public property research; they are not verified title records.