# [Rebilder security](https://rebilder.com/security)

> Mechanism-backed security practices: hashed API keys, encrypted platform tokens, zero card-data handling, row-level security, and a CI-enforced data wall.

## Practices

- API keys are stored as SHA-256 hashes only; the raw key is shown once at creation and never persisted.
- Platform OAuth tokens are encrypted at rest with AES-256-GCM.
- Card data never touches Rebilder: checkout and billing portal are Stripe-hosted (zero PCI surface).
- Database access is governed by forced row-level security; application roles cannot bypass it.
- The data wall between the merchant product and the consumer product is enforced by CI checks on every commit.
- Free-text agent queries pass a fail-closed PII screen before they may be recorded; strings that could identify a person are dropped entirely.
- The CLI and MCP server ship zero telemetry.

## Responsible disclosure

Report vulnerabilities to security@rebilder.com. We acknowledge reports and do not pursue good-faith research.

## Related

- [Privacy policy](https://rebilder.com/legal/privacy)
- [Sub-processors](https://rebilder.com/legal/subprocessors)
- [Status](https://rebilder.com/status)