Legal

Security

The technical and organisational measures behind the privacy policy. Written for the person at your institution whose job is to ask.

Final legal, tax, and operational launch verification is still pending. New Checkout is unavailable until the operator records approval. This policy was last updated 2026-08-03.

The strongest measure is what is absent

Most breach damage comes from data that did not need to exist. Aliquot does not store account passwords, because authentication is managed by Clerk; card numbers, because payment happens on Stripe’s own pages; plaintext IP addresses for allowance metering; or a Curie or Reader message history. Your protocols, inventory, and calculation history remain on your device.

Every one of those is a design decision that can be checked against the source rather than a promise. Saved calculation records are not uploaded automatically. Selected inputs, results, and working are sent only when you explicitly choose Ask Curie, and no table holds a message history.

Measures actually in place

Measure	How
Transport encryption	HTTPS everywhere, HSTS set with a one-year max-age, and no plaintext fallback.
Encryption at rest	Provided by the database and hosting platforms. Aliquot stores no files and runs no disks of its own.
Access to paid features	A signed, HttpOnly cookie carrying an entitlement the server verifies cryptographically. An earlier revision trusted a client-readable cookie, which meant one line in a browser console granted unlimited spend on our API keys. That is fixed, and a test now guards it.
IP handling	Deployed AI routes require a secret salt before addresses are put through HMAC-SHA256 and truncated before storage. Without the salt the hashes cannot be reversed by working through the address space, so the stored value is not a disguised IP.
Spend and abuse control	Per-person monthly allowances plus hourly, daily, and service-wide ceilings, all enforced server-side against a durable counter. A runtime kill switch can disable a cost-bearing surface in seconds without a deploy.
Untrusted input	Every request body is validated and size-capped before it reaches the external AI service. Assistant replies are rendered through a parser that emits React elements only, with no raw HTML path, so AI output cannot inject script.
Prompt injection	The assistant is instructed to treat your messages and any pasted context strictly as data, never as instructions that could change its rules, and to decline attempts to override them.
Dependency surface	Deliberately constrained: Clerk, Stripe, Vercel Analytics and Speed Insights, database, and AI-provider integrations are listed publicly. No advertising SDK is loaded.
HTTP hardening	nosniff, SAMEORIGIN framing, a strict referrer policy, and a Permissions-Policy that allows only the device capabilities the product actually uses.
Failure behaviour	Bounded timeouts, bounded retries with jitter, and a circuit breaker per provider, so a failing dependency degrades instead of cascading.

Where the honest limits are

A Content Security Policy is not yet enforced. The app has inline scripts that must run before paint, and enforcing a strict policy without a per-request nonce would silently break rendering, which is a worse failure than not having it. It runs in report-only mode behind a flag so violations can be observed first.

There is no independent security certification. No SOC 2 report, no ISO 27001, no penetration test by a third party. Saying so is more useful than implying otherwise, and if your procurement process requires one, Aliquot does not currently meet it.

There is no service level agreement, and no promised uptime figure. See Terms.

If a breach happens

We notify the competent supervisory authority within 72 hours of becoming aware of a breach likely to risk your rights, and tell affected users directly where the law requires it. We would also publish what happened. Given what is absent from the database, the realistic worst case is exposure of account identifiers, email domains and billing email addresses, entitlement and subscription references, device IDs and truncated user agents, and usage counts.

Reporting something to us

If you find a vulnerability, write to hello@aliquotchem.com with enough detail to reproduce it. We will confirm receipt, keep you informed, fix it as a priority, and credit you if you want the credit. We will not threaten you, and we will not involve lawyers over a good-faith report.

Please do not run automated scanners or load tests against the live service: it is a small deployment with real users and metered spend, and a scan is indistinguishable from an attack. Ask first and we will arrange a window.