Security Compliance
SalesSheet server-side AI security measures
Server-Side API Key Storage
All AI provider keys stored as encrypted Edge Function secrets. Never exposed to client.
Active
PKCE Authentication Flow
Proof Key for Code Exchange prevents authorization code interception attacks.
Active
CORS Origin Restriction
Edge Functions only accept requests from salessheets.ai domain. All others rejected.
Enforced
XSS Prevention
Content Security Policy headers, input sanitization, and strict HTML escaping on all AI output.
Active
Row-Level Security (RLS)
PostgreSQL policies ensure users can only access their own data. Enforced at database level.
Enforced
Encryption at Rest & Transit
TLS 1.3 for all connections. AES-256 encryption for stored data and secrets.
Active
Security Score
6/6