Security
Access is the product
The marketplace is only useful if matter facts do not leak to the public directory or to experts you did not invite.
Production auth is Auth.js (Google OAuth and email magic links). Neon / Vercel Postgres holds profiles, RFPs, invites, NDAs, and messages. Application code redacts matter facts until an invite is marked active.
Transport is HTTPS on Vercel. Session cookies are HTTP-only. Auth, database, and Blob tokens stay on the server. CVs and RFP attachments use private Vercel Blob objects. Local preview mode stores data on disk for demonstration only and is not a production control.
We do not currently offer a formal SOC 2 report or cyber insurance certificate. Ask if your firm’s vendor review needs a checklist before you put privileged facts on the platform.