How we protect your work.

Accounts

Passwords are hashed with bcrypt. Sessions are signed, HTTP-only cookies that expire after 30 days. Sign-in with Google is available. Password resets use single-use links that expire.

Uploads

Images are re-encoded on upload, which strips metadata such as camera location. They are stored in private object storage and are never served from a public bucket URL; every request passes through an authorization check. NDA regions are blurred on the server before any public response.

Infrastructure

The application runs on Vercel with TLS everywhere and HSTS. Payment details are handled by Stripe and never touch our servers. Every plan limit is enforced on the server.

AI providers

Model calls carry only the case study being drafted and go to providers whose API terms exclude training on inputs. No provider receives your account details.

Reporting a vulnerability

Email security@casepanorama.com. We acknowledge within two business days and will not pursue good-faith research.