Security
SiteAirbag uses narrow runtime authority, tenant isolation and minimized evidence so a customer-site helper does not become account access.
Effective date: 18 oct 2026Runtime credential boundary
A one-time installation code proves one exact origin. Short-lived, origin-bound credentials then permit only scoped configuration, heartbeat, summarized run, rescue outcome and deliberate rescue-request operations. They grant no dashboard, workspace, billing or cross-site access.
Tenant and mutation controls
Supabase Row Level Security checks workspace membership for dashboard data. Server mutations independently resolve the actor and workspace, enforce ownership/plan limits, and use narrowly granted database functions for transactional operations.
Data minimization
Runtime records exclude request bodies, authorization values, original form contents, arbitrary HTML, keystrokes and session replay. Errors and provider states are normalized. Prohibited rescue fields are blocked by a purpose allowlist and submitted secret-like values are rejected or quarantined.
Customer browser policy
SiteAirbag respects a customer's Content Security Policy and Trusted Types rules. Its installed script and API use the configured SiteAirbag origin. When the browser enforces Trusted Types, SiteAirbag uses the named siteairbag policy, limited to that origin; a site that restricts policy names must allow siteairbag in its existing trusted-types directive. If the browser blocks the script or that policy cannot be created, SiteAirbag does not load another way. Rescue and setup controls do not require inline styles. If the policy blocks the API connection, SiteAirbag does not send data through another channel. Browser-reported policy diagnostics are limited to SiteAirbag operations and do not trigger rescue.
Billing and operations
Paddle webhook signatures are verified against the raw request body and events are processed idempotently. Delivery queues, reconciliation, readiness checks and monitored jobs reduce silent failures. Backup availability depends on the production provider plan and is not a contractual recovery commitment. SiteAirbag does not publish an RPO, RTO or uptime SLA. Secrets remain server-only and are classified for sandbox/production consistency.
Assurance scope
SiteAirbag does not claim its own SOC 2 or ISO 27001 certification, PCI DSS certification, independent penetration test, formal bug-bounty program, cyber-liability insurance or contractual uptime SLA. Payment-card processing is handled by Paddle as merchant of record; SiteAirbag does not claim PCI certification for itself.
Responsible disclosure
Send vulnerability reports to security@siteairbag.com with reproduction steps and impact. Do not access another customer's data, use destructive testing, degrade availability, or retain personal data. See the Responsible Disclosure page for scope and expectations. There is no bug-bounty or fixed public response-time promise.
Questions or requests
Support: support@siteairbag.com
Privacy: privacy@siteairbag.com
Security: security@siteairbag.com
Legal: legal@siteairbag.com