Security

Research pages are public record: one per real company, built from governed registers such as FDA clearances and recalls, EU device registrations, registered trials, patents and company filings. They read the same for everyone.

Everything you make is private: your profiles and intake answers, the competitors you track, your conversations with the agent, what it keeps, your tool answers and workflow runs. Only you see them, and the members of a workspace you share them with, by their role.

The app and its API run on Cloudflare Workers. Account and workspace data is kept in Cloudflare D1, stored research and run outputs in Cloudflare R2. Every connection is HTTPS, and Cloudflare encrypts what it stores.

Passwords are stored only as scrypt hashes. A session is a random token in a cookie; we keep only its SHA-256 hash, it expires, and you can end any device’s session from Account. Google sign-in uses OAuth with PKCE, and we never see your Google password.

Owners manage billing and everything else. Admins invite people and change roles. Members read and edit the workspace’s profiles. Viewers read them.

The agent reads the public registers through a read-only account; it cannot write to them. It answers about the profile you have open, and every finding it keeps cites the records that show it, with who kept it and when.

An AI assistant you connect (Claude, ChatGPT, Cursor or another MCP client) signs in through OAuth 2.1 with PKCE and gets a grant to one workspace. Owners and admins see every assistant on the Assistants page and can disconnect it there; what an assistant does is marked with its name.

Billing runs on Stripe. Card details go to Stripe directly and never reach our servers.

Write to hello@commercializer.ai with what you found and how to reproduce it. We answer every report.