Same policy as our numbers: no vague claims, only things you could verify. The full codebase — every API route, the database policies, the auth flow and the Chrome extension — was security-reviewed with Claude Fable 5 in July 2026. The review found no high-severity issues, and every item it flagged has since been fixed — including a second hardening pass that tightened database permissions, added security headers and cleared our dependency advisories. That's an AI-assisted code review, not a formal third-party certification — here's what it checked and what holds:
Every database table has RLS enabled. Your clicks, conversions, leads and revenue are scoped to your account — one account can never read another's rows, even if our app code had a bug.
neo is free right now, and when it isn't, payment goes through Stripe. Card numbers never reach our servers or our database.
Your Meta CAPI access token is stored AES-256-GCM encrypted. Lead emails are additionally stored as SHA-256 hashes for Meta matching.
The dashboard talks to the database with a key that RLS restricts to your own rows. Admin credentials live server-side only and are not in the codebase or git history.
Shopify webhooks are HMAC-signature-verified with constant-time comparison. Platforms without signatures use long random URL tokens you can rotate.
The Chrome extension asks for storage and neoroas.com only. No browsing-history access, no remote code, and it can only read the stats feed for your own workspace key.
Every public endpoint validates its payload with strict schemas and length caps. All database access goes through parameterized queries — no SQL string building anywhere.
Public tracking endpoints, the MCP feed and the extension feed are all rate-limited, and each workspace has a daily click cap with alerting, so junk traffic can't flood your numbers.
Your logged-in session can update your settings and nothing else — not your workspace key, not your webhook tokens. Permissions are granted column by column, and internal database functions can't be called from a browser at all.
HTTPS is enforced with HSTS, the site can't be framed for clickjacking, browsers are blocked from guessing file types, and camera, microphone and location access are switched off outright.
The full payload your store sends us is kept for 30 days for debugging, then wiped automatically by a nightly job. Your counted numbers stay; the raw copy doesn't linger.
We run on the latest Next.js and React, and every high-severity advisory in our dependencies is cleared. The tracking domain is unique to one workspace, so nobody can hijack yours.