Security at SEAREI.
What we do, what we don’t, and what’s on the roadmap. Updated September 2026.
Authentication.
Cookie-first JWT with double-submit CSRF tokens. Password requirements: 12 characters minimum. Sessions expire after 30 days of inactivity.
Encryption.
All SEAREI domains are served over HTTPS, with TLS terminated by our managed hosts (Render and Cloudflare). Files are stored in AWS S3, which encrypts objects at rest. Payment card data is handled entirely by Stripe and never touches SEAREI servers.
Tenancy.
Each organization’s listing photos and compliance artifacts are scoped to your organization in the application and database layer — every read is filtered by your org. A cross-tenant read returns 404: we never reveal that another org’s resource exists.
PII handling.
Sentry runs with send_default_pii=False. PostHog product analytics never receive customer photos or listing details. Anthropic Claude (used to draft optional AI listing-description text) never receives customer photos; under Anthropic’s commercial API terms, inputs and outputs are not used to train their models.
Sub-processors.
AWS S3 (storage and hosting), Stripe (payment processing), Anthropic (AI listing-description text generation), Sentry (error tracking), PostHog (product analytics). Questions about data processing: security@searei.com.
2FA.
On the roadmap; not yet available.
What’s not in v1.
SOC 2 Type II is not yet certified — targeted 2027. Customer-managed encryption keys are not in v1. Single-tenant deployments are not offered. We will not silently change this list; updates are dated and shipped.
Security questions and review requests: security@searei.com.