This platform is built with heavy AI assistance, and this week its founder asked the question out loud: how secure is that, really? For customers, for tradespeople, for the organisations trusting us with their portfolios?
The honest answer starts with an uncomfortable point: who wrote the code is not the security property. AI-written code has the same vulnerability classes as human-written code, plus one distinctive failure mode, code that reads correctly and fails only when exercised. We have caught real examples of exactly that in our own work, which is why nothing here counts as done until it has been exercised against the running system.
What actually protects users is the system around the code. Row-level security on every table holding personal data, with deny-all defaults on new ones. Card details that never touch our infrastructure. Multi-factor authentication enforced, not suggested, for every administrator. An audit trail of who was shown what. Thousands of automated checks that run against production every night, and release gates that refuse a push when any claim the platform makes stops being true.
And the unfinished parts, because an honest answer includes them: an independent penetration test is owed before enterprise pilots carry real portfolios, and a handful of hardening items sit on a dated list rather than in a vague someday. The security page we would show an enterprise buyer says the same things this post does. That is the whole idea.