Skip to content
ColdCredit
Request early access

Security and data handling

What ColdCredit holds, what it never holds, and the controls around it. Written for the IT, compliance or vendor review your organization runs before it sends people a link.
Request the security packet

At a glance

Data about the people you send
Anonymous activity only
Connection to the bureaus
None
Freeze confirmations
Self-reported by the person
SOC 2 report
Not held
Subprocessors
6, listed below
Where data is stored
United States

What never reaches us

The guide opens each bureau's own website in a new tab. Whatever a person types there goes to the bureau, not to ColdCredit, so there is nothing of it for us to store, lose or be asked for.

Never held

  • Social Security numbers
  • Dates of birth or home addresses
  • Bureau usernames, passwords or PINs
  • Names, email addresses or phone numbers of the people you sendThe guide is anonymous: no account and no form asking who they are.
  • IP addresses of the people you sendNever stored. For rate limits our database keeps a keyed hash of the address, which cannot be turned back into it without our secret, in a counter that expires within 30 minutes and is deleted by a daily job.

What we hold

Everything ColdCredit stores, and how sensitive it is.

  • Your team's accounts

    What it is
    Email address, name and a password hash, in Supabase Auth. Optional authenticator-app factor.
    Sensitivity
    Personal data of your staff

  • Your organization

    What it is
    Name, business type, branding (logo, color, favicon) and your links with their wording.
    Sensitivity
    Business data

  • Billing

    What it is
    Stripe customer and subscription IDs, card brand and last four digits, invoices. Card and bank numbers stay with Stripe.
    Sensitivity
    Business data

  • Guide activity

    What it is
    A random ID kept in the visitor's browser, the bureau, what happened (a visit, a bureau marked done, an issue), a shortened browser string, the device type, and whether the visit came from a QR code.
    Sensitivity
    Pseudonymous

  • Issue reports

    What it is
    The kind of problem and an optional note. Emails, phone numbers and long numbers are removed in the browser and again on our server before it is saved.
    Sensitivity
    Could still contain personal data a person typed

  • Activity log

    What it is
    Who changed what in your account and when, without secrets or anything about the people you send.
    Sensitivity
    Personal data of your staff

  • Security events

    What it is
    Your team's sign-ups, sign-ins and security changes (two-factor, password reset, invitations, roles, API keys, checkout) with the IP address, its approximate country and the browser, kept 12 months, for security, fraud prevention and limiting accounts to US businesses. Supabase Auth also records the IP address of each sign-in session.
    Sensitivity
    Personal data of your staff

Controls

How access, encryption and abuse protection work today.

Isolation

ColdCredit runs on its own Supabase project, with its own database, sign-in system and keys, isolated from ColdCredit LLC's consumer product, 3Bfreeze. Inside it, ColdCredit data lives in its own database schema with its own database role, and the project's service key has no grant on that schema. Row-level security keeps each customer to its own rows.

Encryption

HTTPS only, with HSTS. Data at rest is encrypted by Supabase. Card and bank details never reach us; Stripe holds them.

Backups

Supabase takes a daily backup of the database and keeps it for 7 days. The project belongs to ColdCredit alone, so a restore affects only ColdCredit.

Access

  • Owner, admin and viewer roles. Only owners and admins invite people or change the team.
  • Invites go by email and expire after 7 days.
  • Two-factor sign-in with an authenticator app, available on every account.
  • ColdCredit staff must use two-factor sign-in for every staff session, and their changes to your account appear in your activity log.

Abuse protection

  • Cloudflare Turnstile on sign-up, password reset and the contact form, and on sign-in after repeated failures.
  • Rate limits on every public form and on the guide's activity endpoint, refusing requests rather than running unprotected if the limiter is down.
  • New passwords are checked against known breached passwords.

The guide pages

  • Anonymous: no sign-in, no cookies of ours that identify a person, and no third-party analytics or trackers. An explainer video you add shows a play button first and loads nothing from its provider until the viewer presses it; then the provider sees the viewer's IP address and may set its own cookies. YouTube videos play from youtube-nocookie.com.
  • Activity is signed per page, so another site cannot post visits or completions to your analytics.
  • Pages other than the preview cannot be framed by another site.

Subprocessors

The services that handle data for ColdCredit today, what each one sees, and where. We give account owners 30 days' notice by email before adding one, as the data processing addendum describes.

  • Supabase

    What it does
    Database, sign-in and logo file storage
    What it sees
    Everything ColdCredit stores: staff accounts, organizations, links and guide records. Not card or bank numbers.
    Where
    United States

  • Vercel

    What it does
    Hosting the site, console and guide pages
    What it sees
    Every request in transit, and short-lived request logs with IP addresses and browser details.
    Where
    United States, with a global delivery network

  • Stripe

    What it does
    Subscriptions, payments and invoices
    What it sees
    Billing contacts, payment details and invoices. Nothing about guide visitors.
    Where
    United States

  • Resend

    What it does
    Email: sign-in links, invitations, billing notices and contact form messages
    What it sees
    Staff and invitee email addresses and the content of those emails. Nothing about guide visitors.
    Where
    United States

  • Cloudflare Turnstile

    What it does
    Bot checks on sign-up, sign-in after failed attempts, password reset and the contact form
    What it sees
    The IP address and browser signals of the person using those forms. Not used on guide pages.
    Where
    Global network

  • Sentry

    What it does
    Error monitoring and sampled performance tracing
    What it sees
    Error reports and traces from our servers, and from browsers outside guide pages, scrubbed of emails, number patterns, tokens, cookies and request bodies, with no IP addresses and no session recordings. A server error on a guide page can include the page address and the browser description.
    Where
    United States

Planned, not active: Backup storage (holding the nightly encrypted backup of coldcredit's database schema for 30 days). It is not switched on and receives nothing; it will be added to the table above, with notice, before it is.

New passwords are checked against Have I Been Pwned's breached-password list by sending only the first five characters of the password's hash, which identifies no one. The privacy policy describes what we collect and why, and the data processing addendum how we handle the data your guides record on your behalf.

The security packet

For your vendor or IT review. ColdCredit does not hold a SOC 2 report; the packet says so and describes the controls instead.

  • This data inventory and the subprocessor list
  • How the controls above work, in more detail
  • Answers to your security questionnaire
Request the security packet

Found a vulnerability, or think your account or data was exposed? Email security@coldcredit.co. We will acknowledge it and keep you updated, and we will not take legal action against good-faith research that avoids harm to people and their data. Customers are told of a security incident affecting their data as the data processing addendum describes.