Data Security Program
SharpAI maintains a comprehensive data security program consistent with the New York SHIELD Act (General Business Law §899-bb).
Designated Security Coordinator: SharpAI designates an organizational security coordinator responsible for overseeing the data security program, assessing risks, and ensuring ongoing compliance.
Risk Assessment: We conduct regular risk assessments of our systems, network infrastructure, and data processing practices to identify and address potential vulnerabilities.
Technical Safeguards: All data in transit is protected via TLS/HTTPS encryption. Data at rest is encrypted at the database level (PostgreSQL). Passwords are hashed using bcrypt with industry-standard cost factors. Session management uses signed JWT tokens with server-side revocation. Rate limiting is enforced on all API endpoints. CSRF protection is applied to all state-changing operations.
Access Controls: Role-based access control restricts administrative functions to authorized personnel. All admin actions (subscription changes, role modifications) are recorded in an immutable audit log.
Third-Party Vendor Management: We evaluate and monitor the security practices of third-party service providers who process user data, including Stripe (payment processing), Railway (hosting infrastructure), Sentry (error monitoring), and Fireworks AI / Groq (AI chat processing).
Incident Response: In the event of a data breach affecting private information, SharpAI will notify affected users within 30 days of discovery, consistent with NY SHIELD Act requirements. Notifications will describe the nature of the breach and steps users can take to protect themselves.
Data Disposal: When a user deletes their account, all associated personal data is permanently removed from our systems. Cascading deletion ensures no orphaned records remain across related tables.
Ongoing Assessment: This data security program is reviewed and updated regularly. Security measures include periodic secret rotation, dependency audits, and configuration reviews to adapt to emerging threats.
For security concerns or to report a vulnerability, contact us through .
