Security and compliance, in plain terms.
How Alertedly protects your data across competitor intelligence, Investor Intelligence and Vendor Intelligence: what it collects and keeps, and the service providers (subprocessors) that run it.
How your data is protected.
Your data, separated
Accounts, watchlists and reports are stored in Supabase (PostgreSQL) with row-level security, so each customer can only read their own data.
Encrypted in transit and at rest
The site, the API and our calls to the providers below use HTTPS (TLS), and Supabase encrypts stored data at rest.
Scoped, hashed API keys
API keys are scoped to read or write, can be revoked at any time, and are stored only as SHA-256 hashes. The full key is shown once.
Secrets in a vault
CRM keys and firm integration secrets are stored encrypted in Supabase Vault.
No card numbers
Payments run on Stripe's hosted checkout and billing portal. Alertedly never sees or stores card numbers.
Signed webhooks
Stripe webhooks are accepted only with a valid signature, and the webhooks Alertedly sends to your endpoints are signed (HMAC-SHA256) so you can verify them.
Access controlled and logged
Firm admins decide who joins, each member's role and the firm's keys. Every MCP tool call and authenticated API request is logged and rate limited, and firm admins can review their firm's log.
Who runs Alertedly, and what they receive.
These providers run parts of Alertedly. We share data with them only as needed to provide the service, and we do not sell your personal information.
| Provider | What it does | What it receives |
|---|---|---|
| Supabase | What it does: Database, sign-in, file storage, encrypted secrets and server functions | Receives What it receives: Account details, watchlists, reports and settings |
| Hetzner | What it does: Cloud servers that run research, report writing and delivery | Receives What it receives: Tracked companies and the research and reports about them |
| Lovable and Cloudflare | What it does: Website and blog hosting, content delivery and protection against attacks | Receives What it receives: Standard web request data (such as IP address) |
| Anthropic and OpenRouter | What it does: AI models that analyze company information, write reports and answer questions in Alertedly | Receives What it receives: Public company information; questions you ask inside Alertedly |
| Public data and search providers | What it does: Sources of public business information about the companies you track, such as news, posts, job listings and ads | Receives What it receives: Company names, websites and public company profile handles; never your personal information |
| What it does: Optional sign-in with Google | Receives What it receives: The sign-in request; we receive your name, email address and profile picture | |
| Stripe | What it does: Payments, subscriptions and the billing portal | Receives What it receives: Billing details (card data goes to Stripe directly) |
| Brevo | What it does: Report and digest emails | Receives What it receives: Your email address and the report |
| Resend | What it does: Support messages, team invitations and free reports | Receives What it receives: Email addresses and the message |
| Slack | What it does: Delivering reports to a workspace you connect | Receives What it receives: The report or alert |
| ElevenLabs | What it does: Audio versions of report summaries | Receives What it receives: Report summary text only |
| PostHog, Google Analytics and Microsoft Clarity | What it does: Product analytics and session recording | Receives What it receives: Pages visited and how the site is used |
Slack workspaces, CRMs, AI assistants and webhook endpoints you connect receive only what you choose to send them, under their own terms. We may update this list as the service changes. See our Privacy Policy for how we handle personal information.
Public business information in. Your watchlist stays private.
What we collect
Alertedly researches organizations, not private individuals, using publicly available business information.
- For companies: the competitors you choose to track.
- For venture firms: your portfolio and dealflow companies, from the same public sources.
- For Vendor Intelligence: the organizations in your market and the tools they appear to use, at the organization level, without personal contact details.
We don't ask for your internal documents. We store your account details, the companies you track, your settings and the questions you ask inside Alertedly. If you connect a CRM, we read only the company lists you import and write signals back as notes. We never tell other customers which companies you track.
What we keep
- Research and report history about companies, as the long-term record that weekly comparisons and trends are built on.
- Personal information only as long as needed for the purposes in our Privacy Policy, then deleted or de-identified. Account deletion requests go to contact@alertedly.com.
- Reports are AI-assisted research from public sources and can contain errors; they are not advice. See our Terms of Service.
Reviewing Alertedly for your team?
Email the security team directly. For how the MCP server and API sign people in, keep accounts apart and log access, read the security docs.