Security

Comment Coach takes the security of your data seriously. This page describes the measures we use to protect your information.

1. Encryption

Field-Level Encryption at Rest

Every comment, study note, coaching suggestion, and draft you write is encrypted individually using AES-256-GCM before it touches our database. Not just the disk — every column of every row. Even if our database were compromised, your content would be unreadable without the encryption key.

Your study notes are encrypted before they're stored — if our database were ever exposed, your content would be unreadable. To provide features like AI coaching and sharing, our system decrypts your content when you use it.

This applies to all users automatically. There is nothing to enable or configure.

In Transit

All connections use HTTPS/TLS. HTTP requests are automatically redirected to HTTPS. HSTS is enforced with a one-year max-age.

Passwords

Stored as salted bcrypt hashes via BetterAuth. We never store or log plaintext passwords.

2. Authentication & Sessions

• Email verification required before account access
• Secure, HTTP-only session cookies with SameSite=Lax and Secure flags
• Sessions expire after 30 days with 1-day rolling refresh
• Password reset via time-limited, single-use email links
• Account lockout protection via rate limiting on login attempts

3. Security Headers

Every response from Comment Coach includes the following security headers:

4. API & Rate Limiting

• Rate limiting on authentication endpoints (login, signup, password reset)
• Rate limiting on AI coaching calls (daily and monthly caps)
• Rate limiting on share reactions to prevent abuse
• Server-side validation on all API inputs

5. BYOK (Bring Your Own Key)

When you provide your own API key for AI services:

• Your key is stored only in your browser's localStorage — never on our servers
• Keys are transmitted to our server only to relay your AI request, then immediately discarded
• Keys are never written to our database or logs
• You can remove your key at any time from Settings

6. AI & Transcription Data Handling

• Comment text is sent to Anthropic (Claude) for coaching — no personal identifiers are included
• Anthropic does not use API inputs for model training (Anthropic Privacy Policy)
• AI responses are stored in your account as coaching history — you can delete this by deleting the comment or your account
• Audio sent to Deepgram for live transcription is encrypted in transit. mip_opt_out is always enabled, so audio is not retained after processing and is not used for model improvement (Deepgram Privacy Policy)
• Audio recordings from live capture are stored temporarily in your browser (IndexedDB) with a 24-hour expiry — they are never uploaded to our servers unless you explicitly transcribe them
• Images and PDFs uploaded for text extraction are processed in server memory and immediately discarded. They are never written to disk or stored.

7. Infrastructure

• Hosted on Fly.io with private networking and encrypted volumes
• Automated deployments via GitHub Actions CI/CD pipeline
• SQLite database with WAL mode for reliability
• Automated daily backups — backup files contain only encrypted content

8. Breach Notification

In the event of a data breach affecting your personal information, we will:

• Notify affected users via email within 72 hours of discovery
• Report to relevant authorities as required by applicable law (GDPR, CCPA)
• Provide clear information about what data was affected and recommended actions

9. Responsible Disclosure

If you discover a security vulnerability in Comment Coach, please report it responsibly:

• Email: contact@comment.coach
• Subject line: "Security Vulnerability Report"
• Include steps to reproduce the vulnerability

Please do not publicly disclose the vulnerability until we have had a chance to address it. We aim to acknowledge reports within 48 hours and resolve confirmed vulnerabilities promptly.