Trust
Security
A plain description of how account and customer data is protected — see also our Privacy Policy for what we collect and why.
Account security
Passwords are never stored in plain text — they're hashed before they ever touch the database, so no one at VendorSpies, including us, can see your actual password. Sessions are managed with signed, httpOnly cookies. A magic-link sign-in option is also available if you'd rather not use a password at all. Two-factor authentication (via an authenticator app) is available as an opt-in account option — turn it on from your account settings.
Payment data
Card details are entered directly on Stripe's own hosted checkout page. VendorSpies never receives, transmits, or stores your full card number — that responsibility, and the PCI-DSS compliance burden that comes with it, sits entirely with Stripe. Every billing event our systems receive from Stripe is cryptographically signature-verified, so a forged or replayed webhook can't alter your subscription or billing status.
Application-layer protections
The site runs a strict Content Security Policy with a unique, per-request token required on every executable script — the standard defense against cross-site scripting (XSS), and one most small applications skip. Sign-in and account requests are checked against a fixed, literal list of trusted origins to block cross-site request forgery (CSRF). Public API endpoints are rate-limited at the database layer so a single client can't overwhelm the service or brute-force a credential.
Infrastructure
The application is hosted on Vercel with HTTPS/TLS enforced everywhere — there is no unencrypted path to or from the service. The database runs on Neon, a managed PostgreSQL provider with encryption at rest and automated backups. Application secrets (API keys, signing secrets, database credentials) are stored as encrypted environment variables and are validated at build time to ensure none of them can ever be bundled into code that reaches a visitor's browser.
Data minimization
We collect what the product needs to function and nothing more: account info, your monitored vendor watchlist, and notification preferences. There are no advertising trackers, no analytics cookies, and no third-party tracking scripts anywhere on the site — see the Analytics section of our Privacy Policy for the full disclosure.
Ongoing practices
Dependencies are automatically scanned for known vulnerabilities, and updates are reviewed and applied on an ongoing basis rather than left to accumulate.
Reporting a vulnerability
If you believe you've found a security issue, please email support@vendorspies.com with details. We ask that you give us a reasonable window to investigate and fix an issue before disclosing it publicly, and we won't pursue legal action against good-faith security research conducted under this policy.