Trust center
How Entropy handles security and data
Entropy scores other companies' security posture, so ours is held to the same standard. This page covers how to report a vulnerability, how we protect the platform, who processes data on our behalf, and where our own compliance program stands today.
Reporting a security issue
Disclose a suspected vulnerability responsibly by emailing security@entropy.com. We acknowledge valid reports within 72 hours and aim to resolve confirmed issues within 30 days.
Full scope, our commitments to good-faith researchers, and the machine-readable security.txt are on the vulnerability disclosure page.
How we protect the platform
These are observable practices on Entropy's own infrastructure. They are not a substitute for a third-party audit, and none of them is a certification — but they are the same class of signal Entropy measures on the vendors it scores, and Entropy's own domain meets them.
- ▸HTTPS is enforced site-wide with HSTS, and every response carries a Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy header.
- ▸Accounts use Firebase Authentication with optional SMS multi-factor. Vendor profile claims additionally require DNS-record proof of domain ownership.
- ▸Authorization is enforced server-side in Firestore security rules and Cloud Functions, not only in the interface.
- ▸All form input and search queries are validated and sanitized server-side. Evidence uploads are checked for file type and size on the server before storage, and the stored file’s content type is verified against its actual bytes.
- ▸Evidence documents are access-controlled and encrypted at rest, readable only by the vendor who uploaded them and Entropy administrators.
- ▸API keys, service-account credentials, and environment files are kept out of source control. Third-party dependencies have been audited for known vulnerabilities, and any advisory not yet resolved is tracked as documented, accepted risk.
- ▸The scanning pipeline runs as its own service, separate from the web application, and its trigger endpoint requires an authenticated call from a designated service account rather than being publicly invocable.
Data handling & subprocessors
Entropy stores account data, uploaded evidence, and private notes in Google Cloud, hosted in the United States. The following vendors process data on Entropy's behalf. Entropy does not sell personal data or share it with third parties for advertising. See the Privacy Policy for the full account of what is collected and why.
- Google Cloud / Firebase
- Firestore (application data), Firebase Authentication (account credentials and MFA), Cloud Storage (evidence uploads), and Cloud Functions / Cloud Run (backend and scanning). Hosted in the United States.
- Vercel
- Web hosting, and — only after you opt in via the cookie banner — anonymized, cookieless page-view analytics.
- Stripe
- Payment processing for paid vendor subscriptions. The integration is in place but billing is not yet live; when it is, card details are handled by Stripe directly and Entropy stores only a customer reference.
- Resend
- Transactional email — score-change alerts, domain-request notifications, and waitlist confirmations.
Certifications
Entropy does not currently hold third-party security certifications such as SOC 2 or ISO 27001.
As an early-stage company, we have not yet completed the months-long evidence-collection process these audits require. We will list any certification here as we complete it, with the date and issuing body — not before. For why the absence of a certification isn't automatically a mark against a vendor when you're reading a grade, see the methodology page.
Security FAQ
A few questions buyers ask most often about Entropy's own posture. Broader questions about scoring, claiming a profile, and billing are on the full FAQ.
- A vendor I’m evaluating has no SOC 2 — is that a red flag?
- Not on its own. A SOC 2 report takes months of evidence collection over a defined audit window, so a genuinely well-run early-stage company often just hasn't completed one yet. HIPAA only applies to organizations that handle protected health information, and ISO 27001 / ISO 42001 have their own scoping. A missing certification is a reason to ask why it's missing, not an automatic disqualifier. The methodology page explains how to read a certification gap in context.
- Where is Entropy’s data stored?
- In Google Cloud (Firestore and Cloud Storage), in the United States. Uploaded evidence files are encrypted at rest and access-controlled by Firestore security rules.
- How do I report a security vulnerability in Entropy?
- Email security@entropy.com. Full scope and our response commitments are on the vulnerability disclosure page, and the machine-readable version is at /.well-known/security.txt.
- Can other users see the evidence documents I upload?
- No. Uploaded certificates and audit reports are readable only by the vendor account that uploaded them and the Entropy administrators reviewing a claim. A public profile shows only that a document is on file — never the document itself.
- Does Entropy use my data to train AI models?
- No. Vendor scores are computed from publicly observable signals — not from account data, uploaded evidence, or the private notes you keep on profiles.