Security

Starlight holds the keys to your mailbox, your calendar, your CRM, and a list of people you are trying to win. This page describes, factually, how we protect that. It is the public version of Annex 2 of our Data Processing Addendum. Where we have not yet done something, we say so.

Hosting and Infrastructure

• The application runs on Vercel (serverless, United States). The database is PostgreSQL on Supabase, hosted on AWS in us-east-2 (Ohio). Both providers hold SOC 2 Type II reports and publish their own security documentation
• Production is the only environment that holds customer data. Preview and development environments use separate databases
• Secrets (API keys, encryption keys, OAuth client secrets) live in Vercel's encrypted environment store and are never committed to source control

Encryption

• In transit: TLS 1.2+ on every connection, including between the app and the database
• At rest: the database, backups, and file storage are encrypted at rest by our providers (AES-256)
• Integration tokens: OAuth refresh and access tokens for Gmail, Outlook, calendars, and CRMs are additionally encrypted in the application with AES-256-GCM under a key held outside the database, so a database-only compromise does not expose mailbox access
• Extension and MCP tokens are stored as hashes; the plaintext exists only in your browser or client

Authentication and Access

• Sign-in is passwordless: Google OAuth or an emailed magic link. There are no passwords to leak, reuse, or brute-force
• You can sign out of every session from Settings, revoke any connected integration from Connectors, and revoke extension and MCP tokens individually
• MCP access uses OAuth 2.1 with PKCE, short-lived hashed authorization codes, and rotating refresh tokens
• Internal access to production follows least privilege. Infrastructure accounts use multi-factor authentication

Tenant Isolation

Every record belongs to a workspace, and every query is scoped to the workspace of the signed-in user. Underneath that, PostgreSQL row-level security is enabled on every table, and a CI check blocks any schema change that would create a table without it. Teammates see only their own workspace.

Least-Privilege Integrations

• Gmail and Outlook: we read only threads Starlight started and replies to them, never the rest of your inbox. Our use of Google data complies with the Google API Services User Data Policy, including Limited Use
• Calendars: read events and create the meetings you book; nothing else
• CRMs: sync only the records you choose to import or export
• Chrome extension: acts in your own browser with your own session. Starlight never holds LinkedIn, X, or Reddit credentials. Before any automated send, the extension verifies it is in the right conversation with the exact approved text, and aborts otherwise. Full data flows are in the Privacy Policy

AI Data Handling

• We do not train models on customer data, and our agreements with model providers prohibit them from doing so. Zero-data-retention terms are enabled where a provider offers them
• Model calls are routed through the Vercel AI Gateway or directly to the provider over TLS; the providers are listed on the Sub-processors page
• Text that originates from prospects or public posts is wrapped as untrusted data in every prompt, so a message cannot instruct the model
• Every outbound draft is scored by an independent judge model for fabrication before it can be sent automatically; a person reviews everything else

Backups and Availability

• The database is backed up daily by Supabase with the retention of our plan; backups are encrypted and stored in the same region
• Deleting your account deletes your workspace data immediately from the live database; it ages out of backups within the retention window
• Vercel provides automatic failover and DDoS mitigation at the edge

Logging and Monitoring

• Application and request logs are retained by our hosting providers for a limited window and used for debugging and abuse detection
• Security-relevant events (sign-ins, token issuance and revocation, integration connects, agent runs, sends) are recorded as activity on the account
• Dependencies are monitored for known vulnerabilities and updated promptly

Vulnerability Disclosure

We welcome good-faith security research. Report vulnerabilities to legal@joinstarlight.com with a description, steps to reproduce, and impact. Please do not open a public issue. A machine-readable version of this policy is at /.well-known/security.txt.

Scope

• In scope: joinstarlight.com, its API, the MCP server, the Chrome extension, authentication and authorization, data handling and isolation
• Out of scope: third-party services we use, social engineering, denial of service, and issues already known or reported

Safe harbor

We will not pursue legal action against researchers who make a good-faith effort to avoid privacy violations, data destruction, and service disruption; only test accounts they own or have permission to test; report promptly and do not exploit beyond what is needed to demonstrate the issue; and do not disclose publicly before a fix is in place.

Incident Response

If we confirm a security incident affecting personal data, we contain it, assess scope, and notify affected customers without undue delay, with the facts known at the time and the steps we recommend. Where Starlight is the controller and the law requires it, we notify the supervisory authority within 72 hours. Where we are a processor, we notify the customer so they can meet their own obligations.

Compliance Status

Questions about security, including vendor questionnaires, go to legal@joinstarlight.com.