Security should be understandable, not hidden behind badges.
This page describes the controls that are actually implemented in the current founding-validation product.
Payments
Paid Founding Access is handed off to Stripe Checkout. BusinessBuilt AI does not ask customers to type card numbers into the blueprint form. Stripe returns payment and subscription status to the application so provisioning can continue.
Application secrets
Payment, database, email, and administrative credentials are read from server-side environment variables. They are not intentionally placed in public client-side code or customer-facing pages.
Administrative access
Administrative pages and administrative API routes are protected by server-side credentials. If the required administrative credentials are not configured, those routes return an unavailable response rather than opening access.
Blueprint and provisioning data
The product stores the information needed to generate a blueprint, provision the selected configuration, track payment/provisioning state, and provide onboarding. The founding workflow is designed to collect operational answers rather than unnecessary sensitive personal information.
Configuration QA
Generated configurations are not automatically treated as perfect. The system runs configuration QA and separates review items or blocking exceptions so they can be handled deliberately.
Analytics
BusinessBuilt AI uses Vercel Web Analytics for site and funnel measurement. Custom funnel events are designed to avoid sending customer names, email addresses, payment details, or blueprint tokens as event properties.
Founding-phase limits
BusinessBuilt AI is an early-stage founding-validation product. Security controls will be expanded as product scope, customer volume, stored data, team access, and integration requirements justify stronger controls.