Security

Brands pay through Stripe using Stripe Connect (Express). Each creator connects their own Stripe account, and invoice payments route directly to that account on Stripe’s normal payout schedule. Tidepool never holds your funds. Card details are entered on Stripe and never touch Tidepool’s servers.

Data is stored in Supabase Postgres with row-level security that scopes every row to your organization. Contract files live in a private Storage bucket reached only through server-side routes using a service role, never exposed to the browser.

Stripe keys and connected-account tokens are stored encrypted in environment variables. They are never sent to the browser or exposed to clients.

AI features use Anthropic’s Claude for partner research, pitch angles, screenshot extraction, and media-kit copy. Usage is tier-gated and metered. Your data is never used to train third-party models.

Tidepool does not scrape or automate LinkedIn. Analytics come from your LinkedIn Analytics export, which is fully manual. Your LinkedIn account is never connected and is never at risk.

Tidepool is in private beta. We do not yet hold formal certifications such as SOC 2 or ISO 27001, and we will not claim badges we have not earned. We will update this page plainly as our posture matures.