Security

StartupOS is a multi-tenant cloud application. Each workspace's data is isolated at the database layer using row-level security (RLS) policies scoped to the workspace and the signed-in user. A user can only read or modify records in workspaces where they hold a legitimate membership and role.

Data is encrypted in transit using TLS, and sensitive data at rest is protected using database-level encryption. Secrets such as integration API keys are stored in a dedicated secrets vault rather than in application tables, and are accessible only through controlled, access-gated functions.

Access to production systems and data is restricted to authorized personnel on a least-privilege basis. Administrative actions are role-based and logged. User-facing features enforce per-workspace roles (e.g., founder, member, admin) so that teammates only see what their role permits.

User authentication is provided through a managed identity provider with support for email/password and single sign-on (e.g., Google). Sessions are validated on every request, and protected server-side operations reject requests without a valid authenticated session.

Integration credentials you add through the Integrations Hub are written to a secrets vault via access-gated functions and never exposed in plaintext to the client. Keys are revealed only to authorized, server-side operations — for example, when testing a connection you own.

We monitor the platform for availability and abuse, and maintain a process to investigate and respond to security incidents. If an incident affects your data, we will notify affected users as required by law and our commitments.

We use trusted service providers to host infrastructure, run AI models, deliver email, and provide analytics. Each is engaged under agreements that limit their use of your data to providing the service. You control which optional integrations are enabled in your workspace.

We welcome responsible reports of potential security vulnerabilities. If you believe you have found a security issue, please email founders@getstartupos.com with details. We ask that you avoid accessing or modifying data that does not belong to you and that you give us reasonable time to respond before any public disclosure.

This page is an informational security overview. It does not represent a formal compliance certification (such as SOC 2, ISO 27001, HIPAA, or PCI DSS). Where we obtain specific certifications, we will document them here.

For security questions, contact founders@getstartupos.com. For privacy questions, see our Privacy Policy.