How your statements are protected

Isolation is enforced by the database

Every table carrying customer data has row-level security enabled, and each policy compares the row's owner directly against the signed-in account. This runs inside PostgreSQL, not in our application code, so a bug in the app cannot bypass it. A query for another customer's rows does not fail with an error; it returns nothing, because those rows are not visible to that connection.

Unauthenticated requests have no privileges on any table at all.

Least privilege on the columns that matter

A signed-in account can change its own email and name. It cannot change its plan, its billing status, its trial dates, or whether it is an administrator, because the database does not grant write access to those columns from the browser at all. They are only writable by billing processes running with elevated privileges.

Your file never reaches our servers

Statements are parsed in your browser. We receive the extracted rows, not the document, and there is no copy of your CSV anywhere in our systems. If you upload a file and then close the tab before saving, nothing was ever sent.

We store less than the file contains

Society exports carry more than royalty data. Depending on the society, a row may include party and member identifiers, recipient names, IPI or CAE numbers, and occasionally tax IDs or addresses. Those columns are stripped before anything is stored. What remains describes the performance: the cue, the money, the territory, the channel, the period.

Encryption

TLS between your browser and the site, and between the site and the database. Encryption at rest on the database volumes. Passwords are stored only as a one-way hash by our authentication provider and cannot be read by anyone, including us.

We do not claim end-to-end encryption. A service that sums your royalties and compares them against airings has to be able to read them. We would rather tell you exactly where the line is than imply a protection that does not exist.

Accounts

Sign-in is email and password, handled by our authentication provider. Email addresses are confirmed before an account becomes usable. Password reset links are single-use and expire.

Reporting something

If you find a security issue, email hello@ontrk.app and we will respond within two business days. We will not take legal action against anyone who reports a genuine vulnerability in good faith and gives us a chance to fix it before disclosing it.