Straight answers to the serious questions: what we built, what we haven’t built yet, and why.
Written for clients, partners, investors and app reviewers. Technical words come with a plain meaning in brackets.
Our terms and privacy policy are still drafts (see “Are your legal texts final?”). This page describes what is built and running today.
Privacy & GDPR
Is Big Cat GDPR compliant?
Big Cat is run from France, so the GDPR and French law (Loi Informatique et Libertés, CNIL) apply to everything we do, for every user, wherever they live. In place today: a register of every processing activity (art. 30), a lawful basis for each one, EU storage, a contract with every provider, in-account download and deletion, and a written breach plan. The gaps are listed openly on this page, with their reasons: we don’t call ourselves “fully compliant” while any of them is open.
What personal data do you collect?
Your email (and, with Google sign-in, the name and picture Google sends, which we don’t use); what you put on your site (business name, words, offers, business contact, photos, the people you choose to show); the link or picture of the design you love; your plan status and Stripe references; invoices (name, email, amount, date); technical logs (IP address, time, errors) for 30 days at most. No card numbers, no IP address in our database, no device fingerprint, no analytics profile.
Do you share data with third parties?
Only with the processors that run the service, each for one job and under contract: the AI (Anthropic), payments (Stripe), hosting, database, email and backups (see “Who are all your processors?”). There are no analytics or advertising partners at all. Authorities get data only when the law requires it, for example a court order or a report of child abuse.
Do you sell my data?
No, never, to anyone. Our only income is your plan. We don’t rent lists, share data with other clients or use it for advertising.
Is Big Cat a controller or a processor?
Both, for different data. We are the controller (we decide why and how) for your account, your site’s content, payments, logs, backups and the safety check. When a business client publishes a site that holds other people’s data (a team page, testimonials, photos), we are that client’s processor (we host it on their behalf) and the client is the controller.
What are your lawful bases?
Contract (art. 6(1)(b)) for your account, building and hosting your site, and payments. Steps you ask for before a contract for the free first look. Legal obligation for invoices (10 years), privacy requests and reports to the authorities. Legitimate interest for security logs, backups and the content safety check. Consent only for the “Stay updated” email list, and you can withdraw it with one click.
Do you sign a DPA with business clients? Not yet
Not yet. A DPA (data processing agreement, GDPR art. 28) is needed when your site holds other people’s data; our terms don’t have that clause yet because they are still drafts. It is being written into the terms, so every business client gets it by accepting them. On our side, we already have a DPA with each of our own providers.
How do I use my privacy rights, and how fast do you answer?
In My account, “Download my data” gives you everything we hold about you in one machine-readable file (JSON), and “Delete my account” deletes it all 30 days later. For anything else (correction, objection, restriction, a question) write to contact@bigcat.website: we answer within one month, the GDPR limit (art. 12(3)). You can also complain to the CNIL (cnil.fr).
Do you have a DPO?
No, and the law doesn’t require one (GDPR art. 37): we are not a public body, and our core activity is neither large-scale monitoring of people nor large-scale sensitive data. The founder is the privacy contact and answers herself at contact@bigcat.website.
Do you keep a record of processing?
Yes. Our art. 30 register follows the CNIL’s own model and lists 12 processing activities, plus the one we do as a processor, each with its purpose, lawful basis, data, providers, transfers, retention and security measures. It is an internal document; we show it to the CNIL on request.
Have you done a DPIA? Not yet
Not yet. A DPIA (data protection impact assessment, art. 35) is advised for one activity: the AI safety check that reads every site’s words and uploaded photos. That check went live on 29 Oct 2026; its impact assessment is the next privacy document we write, with the CNIL’s free PIA tool.
Are your legal texts final? Not yet
Not yet. Our terms and privacy policy are online and say exactly what the product does, but they are marked as drafts: French consumer law requires us to name a consumer mediator in them, and our registration with one is in progress. Once it is done we publish a numbered version, and from then on we record which version each person accepted and when.
↑ Back to the list
Where your data lives
Which providers store my data, and in which region?
Database, sign-in and photo originals: Supabase, Frankfurt (eu-central-1). Published sites and our backups: Cloudflare R2 with the EU jurisdiction setting (data stays in the EU). The app’s server code: Vercel, Frankfurt (fra1). Published pages are delivered by Cloudflare’s worldwide network, so visitors far away get them fast, but they are stored in the EU.
Who are all your processors?
Supabase (database, sign-in, files), Vercel (runs bigcat.website), Cloudflare (published sites, backups, DNS, email forwarding), Anthropic (the AI, Claude), Resend (emails, sent from Ireland), Stripe (payments, through Stripe Payments Europe in Ireland), MailerLite (the “Stay updated” list only, an EU company) and Google Web Risk (link addresses only, once its key is switched on). Each one is bound by a data processing agreement. A new provider is added to our privacy policy before it is used.
Is all processing done in the EU?
No, and we say where: what the AI reads (Anthropic, USA), email delivery data (Resend, main processing in the USA), link addresses (Google Web Risk, USA), possible support access by our US-based providers, and Stripe’s own processing. Our own storage (database, files, backups) stays in the EU. Every transfer is covered by the EU Standard Contractual Clauses (SCCs, the Commission’s model contract, 2021/914); Vercel, Cloudflare, Resend and Stripe are also certified under the EU–US Data Privacy Framework (DPF). The DPF was upheld by the EU General Court in September 2025 and an appeal is pending; if it ever falls, the SCCs keep covering the transfers.
Is my data encrypted in transit?
Yes. Everything is served over HTTPS (TLS) only, on bigcat.website and on every published site, with certificates managed by Vercel and Cloudflare. HSTS (a header that tells browsers never to use plain HTTP) is set for 2 years on bigcat.website and 1 year on published sites, subdomains included. Calls between our servers and our providers are HTTPS too.
Is my data encrypted at rest?
Yes. Supabase encrypts its databases and files at rest (AES-256), and Cloudflare R2 encrypts every stored object. Our backups get a second, own lock on top: each file is encrypted with AES-256-GCM, and that key is locked with a 4,096-bit RSA public key. The private key exists only in the founder’s password manager, never on a server, so a stolen backup file is unreadable.
What does Big Cat collect about the visitors of my site?
Nothing in our database. Published sites set no cookie and run no tracker. An email box on your site sends straight to your own tool (Mailchimp, Kit) or opens its sign-up page, and Buy buttons are plain links to your payment service, so those details never pass through Big Cat. Only Cloudflare’s standard request logs (IP address, time, page) exist, and they expire by themselves.
↑ Back to the list
AI & intellectual property
Which AI do you use?
Claude, made by Anthropic, through its paid API under Anthropic’s Commercial Terms. Claude Sonnet writes and designs your pages and runs the cat designer; Claude Haiku runs the safety check. We have no AI model of our own and train or fine-tune none. What is ours is the design engine around it: plain code, no AI, that measures the design you love (proportions, type, colours), lays out the page and runs every check.
Does the EU AI Act apply to Big Cat?
Yes, lightly. Anthropic is the provider of the general-purpose model (Claude); Big Cat builds an AI system on it through the API. Website building is not a high-risk use (it isn’t in the Act’s Annex III), so our duties are the transparency rules of art. 50, which apply since 2 August 2026: people must know they are dealing with an AI, and AI-generated content must be identifiable. What we do today is in the next answers; machine-readable marking of AI output is not built yet.
What exactly is sent to the AI, and when?
Free first look, before sign-up: your business name, your description, the words of your own web page if you paste its link, and a picture of the design you love; not your own photos. In your account, only while AI help is on: your site’s words and what you ask the cat designer. The safety check: your site’s words, the photos you upload and where your links go. Never sent: your password, your payment details, your visitors’ data.
Is my data used to train AI?
No. Under Anthropic’s Commercial Terms and its data processing addendum, Anthropic works for us as a processor and may not train its models on what we send. Big Cat trains no model either. We sell no data and share none with other clients.
How long does the AI provider keep what it reads?
Anthropic deletes our inputs and outputs within 30 days. The one exception is its own: content flagged as breaking its usage policy may be kept up to 2 years. On our side, the free first look and the cat designer chat are not stored at all (the chat stays in your browser); we keep only the number of trial messages, never their content.
Can I switch the AI off?
Yes. “AI help” is a switch in My account, set by the account owner and checked on the server before every AI answer in your account. While it is off, none of your words or requests go to the AI; you edit everything yourself. Your choice is recorded with its date, as proof of consent (GDPR art. 7(1)).
Is there any exception to the AI switch?
One: the safety check always runs, even with AI help off, because nothing goes live or stays online without it. It reads your words and uploaded photos only to check them against the law and our terms, and its answer is a verdict (allow, hold or block), never an edit of your site.
Does a human review AI decisions?
Yes. Anything the AI is unsure about is held, and a person at Big Cat decides before it can go live. Clear breaches are blocked automatically, and you can always ask a person to look again. Closing an account or reporting to the authorities is always a person’s decision, never the AI’s.
Are AI results identified as AI? Not yet
In words, yes: the cat designer chat says your messages go to our AI, and our terms say plainly that the cat designer is an AI (Claude) and that the words Big Cat writes for you are written with AI. Not yet: a machine-readable mark inside generated files (art. 50(2)). Your site’s photos are yours or licensed real photos, not AI images.
Who owns the website Big Cat makes?
You do: our terms say “your site is yours”, and your own words and photos stay yours. We use them only to build, host and show your site. One honest legal point: in EU law, copyright protects human creative choices, so text produced by AI alone may not be protected; your own words, choices and edits are.
How do you avoid copyright infringement?
A design you love gives us its feeling and proportions only, never its words, pictures, logo, exact fonts or exact layout, even if asked. Fonts are open-licence families (SIL Open Font Licence) served with their licence file; library photos come from Unsplash and films from Pexels under their free licences, each logged with its source. You confirm you hold the rights to what you upload, and anyone can report a copy at /report.
Can the AI publish, or act, on its own?
No. The AI proposes; it has no keys and runs no code. A site goes live only after fixed, non-AI checks: you approved that exact version (identified by its digest, a fingerprint of its content), it matches the expected schema, every photo was cleared, the safety check passed, and the publishing rules carry the founder’s digital signature (ed25519). Words and photos are passed to the AI as data, never as instructions, which limits prompt injection (hidden orders inside content).
↑ Back to the list
Other EU and French rules
Do the cookie rules (ePrivacy) apply? Why no consent banner?
Yes (ePrivacy Directive, art. 82 of the French Data Protection Act). We use two cookies, both exempt from consent under the CNIL’s rules, so there is no banner: the sign-in cookie and bc_lang, which remembers your language for one year (the CNIL exempts a language choice the visitor makes). No analytics, no advertising, no tracking pixels, on bigcat.website and on the sites we host for you.
Does the Digital Services Act (DSA) apply?
Yes: we host our clients’ sites, so Big Cat is a hosting service. That gives us the host’s liability rules (art. 6) and duties: a point of contact, clear terms, a notice-and-action form (art. 16), a statement of reasons for every decision (art. 17) and reporting suspected crimes that threaten life or safety (art. 18). As a micro-enterprise, we are exempt from the extra duties of online platforms (art. 19) and from transparency reports (art. 15(2)).
Does the Digital Markets Act (DMA) apply?
No. The DMA only applies to “gatekeepers”, very large platforms designated by the European Commission. Big Cat is nowhere near that.
Which consumer rules do you follow? Not yet
French consumer law, for everyone who buys as a private person: a 7-day free trial with no card; 14 days to change your mind after paying, with the unused days refunded; prices shown in full; cancelling online, as easily as signing up (French law requires it), through Stripe’s customer portal in My account. Not yet: the name of our consumer mediator, because our registration (CM2C) is in progress. Paid plans open once it is done and named in the terms.
Does the European Accessibility Act apply?
Not to Big Cat today: the Act (in force since 28 June 2025) exempts micro-enterprises that provide services, and Big Cat is one. We still build for it: real headings, 16 px minimum text, 44 px tap targets, keyboard focus, alt text on site photos. We have not had a formal WCAG audit (the accessibility standard). Your own site may fall under the Act if your business is larger.
Is Big Cat in scope of NIS2?
No. The NIS2 directive (cybersecurity duties for essential and important entities) covers medium and large organisations in listed sectors, plus a few named services such as DNS and trust services. A one-person micro-enterprise building websites is below its size threshold. We still apply its spirit: risk measures, an incident plan, provider security.
What about the French LCEN and the legal notice?
The LCEN (French law on trust in the digital economy) requires a legal notice: ours names the publisher, the publication director, the contact and our hosts (Vercel, Cloudflare, Supabase), and every page links to it. As a host under art. 6 of the LCEN, we act quickly on illegal content we are told about. Every site we publish carries its own legal page too.
↑ Back to the list
Who can see your data
Who at Big Cat can see my data?
One person: the founder. Big Cat is a one-person business (a French sole trader), so there is no team with database access, no contractors and no outsourced support. She looks at content only when it is needed: a held item on the safety review list, a report, or your own request.
How are accounts kept apart?
By row-level security (RLS, a rule inside the database that filters every row by who is asking), switched on for every table. Each query runs as you, so you only ever see your own spaces, sites, photos and settings, and removing someone from a space takes effect at once. Our tests run the real database migrations and check that one account cannot read or change another’s data.
What about admin keys and server roles?
Least privilege: each server job logs in as its own database role (worker, publisher, owner), and none of them can bypass row-level security. Only the publisher role can make a version live, and it only writes the live pointer. The service role key (Supabase’s full-access key) stays on the server, for backups, deletions after 30 days and the safety records; it never reaches a browser.
Who can open the safety review page?
Only the email addresses on an allow-list kept on the server (empty by default, so nobody), signed in with a confirmed email. Anyone else gets “not found”: the page doesn’t even admit it exists. A held photo shows blurred until the reviewer chooses to see it; a suspected child-abuse image is never shown at all.
Is two-factor sign-in on for your admin accounts? Not yet
Not yet confirmed for all of them. Our own checklist requires two-factor sign-in (an authenticator app or a passkey, not SMS) on every account that reaches your data: email, Supabase, Vercel, Cloudflare, GitHub, Stripe, Anthropic and the domain registrar. Until every box is ticked and checked, we don’t claim it.
Do you keep an audit log?
Yes. Sensitive actions (account deletion, publishing, the emergency brakes) are written to an append-only log: a database trigger refuses any change or deletion of a row, even by us. Acceptances of the terms and AI-help choices are kept the same way, in their own append-only record. It stores an account id, the action and the time; no IP address, no device details. One limit: the founder’s direct work in the Supabase dashboard is recorded by Supabase, not in this log.
↑ Back to the list
Signing in
How do people sign in?
Three ways, all run by Supabase Auth: a one-time 6-digit code or link by email (no password needed), “Continue with Google” (OAuth), or a password you choose to create in My account. The email link uses PKCE (it only works in the browser that asked for it).
How are passwords stored?
Only as a hash (a one-way scramble, bcrypt), stored by Supabase Auth. Nobody, Big Cat included, can read your password. Big Cat’s own code never receives it.
Do you block passwords that appeared in leaks? Not yet
Not yet. Supabase offers leaked-password protection (it refuses passwords found in the Have I Been Pwned database); it wasn’t switched on when the optional password was added. Switching it on is one setting, and it is on our list. Most people sign in with the email code and have no password at all.
How are sessions handled?
Each sign-in creates fresh tokens; Supabase uses short-lived access tokens and single-use refresh tokens. The session cookie is host-only (bigcat.website only) and SameSite=Lax (not sent with requests started by other sites). Signing out ends your sessions on every device. Published sites live on a separate domain, bigcatwebsite.com, so they can never read or set bigcat.website cookies.
How do you stop bots? Not yet
The free AI first look sits behind Vercel BotID (an invisible check that a real browser is calling) plus per-visitor limits. For sign-in emails, a Cloudflare Turnstile check is built and waits for its key to be switched on; until then, Supabase’s email rate limits apply. Turnstile is invisible for most people and shows a small box only when Cloudflare is unsure.
Can I add two-factor sign-in to my Big Cat account? Not yet
Not yet. The default sign-in is a one-time code sent to your inbox, so whoever signs in must hold your email; that makes your email account the key, and we advise two-factor there. An extra factor for Big Cat accounts (an authenticator app) is supported by Supabase and matters most for people who add a password; it isn’t built yet.
↑ Back to the list
Application security
What can a published site run?
No JavaScript at all. Published sites are static HTML and CSS, served with a CSP of default-src none: no script, no third-party code, no cookie, no tracker. Forms can only send to an email address or to your own mailing tool. AI-written output is never executed, which removes whole classes of attacks (cross-site scripting, malicious packages).
How do you prevent cross-site request forgery?
Every API route that changes something or spends money starts with a same-origin check: it accepts only requests the browser marks as coming from bigcat.website itself (Sec-Fetch-Site, or an exact Origin match) and answers 403 to everything else, before reading the request. Server actions use Next.js’s built-in Origin check. A test fails if a new route forgets the guard.
Do you rate-limit?
Yes. The free first look has limits per visitor, per minute and per day (an IPv6 visitor counts as their whole /64 block), counted in memory and never stored. The cat designer allows 12 messages per 10 minutes and 80 a day per person, with a daily ceiling for the whole service; the trial has 30 messages in total. The report form is throttled in the database, and a spending cap on our AI account is the hard limit behind all of it.
How do you handle links people paste?
Our fetcher is built against SSRF (server-side request forgery, tricking our server into reaching private systems): HTTPS and standard ports only, no credentials in the address, every DNS answer checked at connection time against private and internal ranges, at most 3 redirects with each hop re-checked, one 8-second deadline and a size limit. Nothing fetched is stored.
What happens to the photos I upload?
They land in a private storage folder that only you can open. Before any photo can appear on a site, the server checks it is a real image (not just its file name), limits its size (10 MB, 40 megapixels), turns it upright, removes all hidden metadata (EXIF: GPS location, camera, dates) and re-saves it as a fresh WEBP file. Only that clean copy is published; the original never goes public.
How do you manage secrets and keys?
Server-side only: Vercel environment variables, Supabase Vault (the Stripe webhook secret, the backup trigger token) and Supabase function secrets. No key is in the code, the browser, an email or a chat, and only the founder holds them. Our security scanner checks the code and its git history for leaked keys, and the breach plan has a rotation step for every provider.
How do you keep dependencies up to date? Not yet
By hand for now: our security scanner runs npm audit and lists outdated packages, and we update when we work on the code. There is no automated update bot (Dependabot or Renovate) in the repository yet; adding one is a small step and is next on this list. We keep the dependency list short on purpose, and published sites carry no packages at all.
↑ Back to the list
Content safety
How do you keep illegal content off Big Cat?
Three layers, live since 29 Oct 2026. Before publishing, the AI reads every word and every photo you upload, and anything banned (sexual content, anything involving minors, weapons, drugs, fraud, hate, terrorism, among others) is blocked or held for a person. Every 3 days, live sites and their links are checked again; only new or changed content is re-read. Our terms set the rules, and anyone can report a site. If the check can’t run, publishing waits: it never skips.
What happens with suspected child sexual abuse material?
It is blocked at once and never shown, even to us. We keep no copy of the image: only the account, the time, the category and a SHA-256 fingerprint (a code that identifies the file without containing it). The account is frozen, and a person at Big Cat reports it to the French authorities (PHAROS, internet-signalement.gouv.fr). Nobody at Big Cat opens or downloads a suspected image.
Do you match images against known abuse material? Not yet
Not yet. Cloudflare’s free CSAM Scanning Tool compares images on published sites with fingerprints of known child-abuse images (lists from NCMEC, the US child-protection centre) and reports matches. It is chosen and described in our privacy policy, but not switched on yet: it is a switch in our Cloudflare account, one of the founder’s own steps. The AI check above already runs on every photo meanwhile.
How does notice and action work (EU Digital Services Act)?
Anyone, signed in or not, can report a site at bigcat.website/report (DSA art. 16). The form gives a reference number as proof of receipt, a person reviews the report, and the reporter’s name and email are optional for a child-abuse report. Reports are kept 1 year after the decision. Suspected crimes that threaten someone’s life or safety go to the authorities (art. 18).
Will you tell me why my content was held or blocked? Not yet
Yes: by email, with the reason and how to contest it (a statement of reasons, DSA art. 17), and you can ask a person to look again. The emails are built; the key that sends them isn’t set yet, so they wait in a queue and a daily job sends them as soon as it is. Meanwhile the screen tells you that publishing was stopped. The one case with no email is suspected child-abuse material.
What do you keep about safety decisions? Not yet
The design: a fingerprint of what was checked and its verdict (so the same content isn’t paid for twice), and for anything held or blocked a short record (account, site, time, categories, short reason, which photo), deleted 1 year after the decision. Not yet: the database table for these records (migration 0018) waits for the founder’s go-ahead. Until it is added, nothing is recorded and every publish is checked again, and blocking still works.
↑ Back to the list
Incidents & breaches
Do you have an incident response plan?
Yes, written on 29 Oct 2026: the first hour step by step (write the time, stop the leak, keep the evidence), a key rotation table for every provider, the CNIL’s criteria to judge the risk, ready email templates in English and French, and a breach log. Emergency brakes in the database can stop sign-ups, generation, AI and publishing at once. No breach has been recorded as of 29 Oct 2026.
Will you notify the authority, and when?
Yes: the CNIL within 72 hours of becoming aware of a breach that is a risk to people (GDPR art. 33), in two steps if needed (what we know first, the rest later under the same reference). A breach with no risk (for example an encrypted backup file whose key stayed safe) is still written in our breach log, with the reason. An attack also means a police complaint; illegal content goes to PHAROS.
Will you tell me if my data is affected?
Yes. If the risk to you is high, we email you directly without undue delay (art. 34): what happened, which data, what we did, what you can do. If you are a business client and your site’s data is affected, we tell you without undue delay (art. 33(2)), because you may have to notify your own authority. Our AI provider must tell us of a breach on its side within 48 hours.
Have you tested the plan? Not yet
Not yet. The plan was written on 29 Oct 2026 and hasn’t been rehearsed in a tabletop exercise (a dry run on a made-up incident). The parts that are code are tested: the emergency brakes and the backup restore have their own checks. A dry run of the full plan is the next step.
↑ Back to the list
Deletion & retention
What happens when I delete my account?
Everything goes 30 days after you ask: account, sites, words, photos. During those 30 days you can sign in and cancel. After the purge, our encrypted backups roll over within 7 days, so your data is gone from them too. The one exception is invoices, which the law makes us keep.
Can I export my data?
Yes, any time, in My account: “Download my data” gives one JSON file with everything you can see (GDPR art. 15 and 20), read through your own session so the same access rules apply. Photos come as links that work for one hour.
How long do you keep each kind of data?
Account and site content: until you delete them, plus 30 days, plus 7 days of backups; invoices: 10 years (French accounting law); technical logs: 30 days at most; safety records and site reports: 1 year after the decision; “Stay updated” email: until you unsubscribe, 3 years at most; your emails to us: 3 years after our last exchange, 5 years if they concern a contract or a dispute.
How long is the audit log kept? Not yet
Not limited yet. The proposed period is 12 months (the CNIL advises 6 months to 1 year for logs); the purge function exists but isn’t scheduled yet. The log holds only an account id, an action and a time, no IP and no device, which keeps it small meanwhile.
↑ Back to the list
Availability, backups & exit
How reliable is the hosting?
Published sites are static files served by Cloudflare’s global network, so they don’t depend on our app or database being up. The app runs on Vercel, the database on Supabase (paid plan). We don’t promise 100% uptime and offer no SLA (service level agreement) yet; our terms say so plainly.
How are backups done?
The whole database every day and every new or changed photo every hour, copied to Cloudflare R2 in the EU, encrypted with our own key, kept 7 days. Supabase also keeps 7 daily copies of the database, so it lives in two places. Each run is logged; a photo that fails to copy is retried in the next runs.
Do you test restores?
Yes, with a script that opens the newest database copy and every photo with the private key and counts them, run on the founder’s computer (the key never goes to a server). One honest gap: we don’t keep a dated log of each monthly run yet, so we can’t show you proof of every test.
Do you monitor uptime? Is there a status page? Not yet
Not yet. Today we rely on our providers’ own monitoring and status pages (Vercel, Supabase, Cloudflare). An external monitor with alerts on the key features (sign-in, publishing, published sites) is on our build list, and so is a public status page after it.
What happens to my site if Big Cat stops? Not yet
Today you can download all your data (words, settings, photos) at any time, and if you use your own domain, it stays yours: you point it elsewhere. Not built yet: a one-click export of your finished site as ready-to-host HTML files, and a written notice period in our terms for the day the service would close. Both are on our list because leaving should be as easy as arriving.
↑ Back to the list
Testing & audits
How is the code tested?
An automated suite of about 1,800 tests runs before every deploy, including security tests: row-level security on the real database migrations, sign-in and session rules, the same-origin guard on every route, photo cleaning, the content safety check and the publishing gates. A deploy goes ahead only when the whole suite passes. Nothing goes live without the founder’s explicit yes.
Do you run security scans?
Yes, our own scanner, built on a 50-point security checklist: keys in the code and its history, exposed files, source maps, security headers, cookies, CORS, risky code patterns and npm audit, on the code and on the live site. Anything it can’t prove is marked unverified, never passed. It is a scanner, not a substitute for an outside review.
Have you had an external penetration test? Not yet
Not yet. Big Cat launched in October 2026 as a one-person business, and a professional penetration test (outside experts trying to break in) costs more than our launch budget allows. It is the first outside review we will buy; until then, our own tests and scanner are what we have, and we say so.
Are you SOC 2 or ISO 27001 certified? Not yet
No. These certify an organisation’s security processes over months, with an outside auditor, and are built for teams; for a one-person micro-business at launch, the cost and the process don’t fit yet. What we do instead: we build on providers that hold them (Supabase SOC 2 Type 2; Vercel, Cloudflare and Anthropic SOC 2 Type 2 and ISO 27001; Stripe PCI DSS Level 1), and we publish our gaps here.
↑ Back to the list
