Real practices, described plainly.
This page describes what Picked By GPT does today. It's maintained by the app owner and does not represent independent certification.
Data in transit
All traffic between your browser and our services is encrypted with HTTPS (TLS 1.2+). API calls from our backend to third-party providers also use TLS.
Data at rest
Our production database and file storage are hosted on managed cloud infrastructure with encryption at rest enabled by default.
Access control
- Row-Level Security (RLS) is enabled on user-facing tables — customers can only read and write their own records.
- Privileged operations (admin work, webhook writes) go through server-only code with the service-role key. That key is never sent to browsers.
- Team members access production tools through individual accounts with strong passwords and two-factor authentication where supported.
Hosting & subprocessors
We host on managed cloud platforms and rely on a small set of subprocessors (analytics, payments, email, AI providers). The full list is on the Subprocessors page.
Secret management
API keys, database credentials, and provider secrets are stored in our platform's encrypted secret store — never in the code repository, never in client-side code.
Shared responsibility
- Platform availability and patching
- Encryption in transit and at rest
- Access-control enforcement (RLS, role checks)
- Incident response for issues we control
- A strong, unique password on your account
- What you choose to publish through us
- Notifying us of a compromised account
- Compliance with your industry's regulations
Reporting a vulnerability
Email info@pickedbygpt.com with details. We reply within 3 business days to responsibly-disclosed reports.
What we don't claim
We are not currently SOC 2, ISO 27001, HIPAA, PCI, or GDPR certified. If and when we complete an audit, we'll publish the report or letter here.