Small scope, explicit controls.

Radar is operated by We Scale Startups. The public site you are reading is a marketing page, a read-only fictional demo and a pilot application form — it holds no customer communications, so its attack surface is deliberately small. This page describes how the site is secured today and the posture planned for the design-partner pilot.

The site today

• All pages are statically generated. There is no login.
• The demo renders a typed, fictional dataset compiled into the site. It does not query a database because none is needed for it.
• The pilot application form is the site's only write path. It inserts directly into a Supabase Postgres table in London using a publishable key that can only insert, never read: row-level security rejects anything except a well-formed application from this site, a database trigger throttles repeats by email and browser, and applications are only ever read by us through Supabase's authenticated dashboard.
• Every connection uses HTTPS with HSTS. A strict Content-Security-Policy blocks requests to every origin except this site and our database endpoint, and blocks external scripts, fonts and images.
• The site is hosted on Vercel with application functions pinned to the London region; edge delivery may operate globally.
• Dependencies are audited on every change in continuous integration, and security updates to the framework are applied as they are released.

Planned pilot posture

The pilot version of Radar will process selected client communications for pilot customers. Its security controls are designed before the first byte of customer data arrives:

• Workspaces isolated per customer with database row-level security.
• Communication content never used to train models.
• Read-only connections to source tools wherever the provider supports it.
• Recommendations are drafts — Radar never sends messages to clients.
• Defined retention: pilot workspace content deleted no later than 30 days after a pilot ends, sooner on request.

The pilot privacy pack — draft DPA, DPIA screening, retention policy and sub-processor list — is prepared and shared with pilot customers before onboarding.

Reporting a vulnerability

Report a suspected vulnerability privately to daniel@wescalestartups.com. Include the affected route, time and reproducible behaviour. We will acknowledge a credible report and coordinate remediation directly. The same contact is published at /.well-known/security.txt.

Read the privacy notice or ask about the pilot.