TibebSecurity
What happens to your data
Every control on this page exists in Tibeb's code today. What doesn't exist yet is said plainly, so you can judge Tibeb on what it is rather than what it hopes to be.
Last updated 9 November 2026.
- SOC 2Not yet startedType I planned
- SSO / SAMLPlannedEmail and password today
- Penetration testPlannedNo external test yet
- Security questionnaireOn requesthello@tibeb.trade
The path your data takes
A request goes from your browser to Tibeb's server and, where the work needs it, on to the database and the model provider. Nothing else receives your theses or your account.
Your browser
Over HTTPS. The site tells browsers to use HTTPS only (HSTS, one year).Tibeb's server, on Railway, in the United States (US East)
Checks your sign-in on every request, then reads or writes only your own records.Postgres on Supabase, with row-level security per login
Each query runs as your login, so the database itself — not only the app — keeps one login from reading another's rows. The tables sit in their own schema, which Supabase's public data API does not serve.The model provider: Anthropic's API
The question, sources and notes a draft or a review needs are sent to write it.
Your password goes from the sign-in page straight to Supabase's sign-in service. Tibeb's server never
receives it; it receives a signed token, checked against Supabase's published keys.
Your card is entered on Stripe's own checkout page. Card details never reach Tibeb's server; Tibeb keeps
Stripe's reference to the card, its brand and its last four digits.
Vendors that touch customer data
| Vendor | What it does | What it receives |
|---|---|---|
| Railway | Hosts Tibeb's server and its storage volume, in US East | Everything the server handles |
| Supabase | Sign-in, and the Postgres database for research data | Your email and password (for sign-in); your theses, sources, notes and chats |
| Anthropic | The AI models that draft, review and read filings | The text a request needs: a thesis's question, sources and notes |
| Stripe | Payments: plan subscriptions, credit packs, refunds and the billing portal | Your name, email and card (entered on Stripe's page) |
| Resend | Sends Tibeb's email: invites, password links, notices | Your email address and the message |
| Massive | Market data | Ticker symbols only, never your account |
| SEC EDGAR | Public filings | Company identifiers only; requests name Habesha Market Research, as the SEC asks |
Other public sources (research papers, news searches, posts on X) receive the search words and symbols a request needs, never your account. Your browser also loads fonts from Google Fonts and, on the Desk, TradingView's chart widgets, which come from TradingView's own servers.
Controls in place today
Isolation and access
- Row-level security per login on research data and desk records.
- Research data needs a verified sign-in: a bad or missing token never falls back to a shared identity.
- The research library and every admin route are the owner's alone, refused to anyone else.
- Every route is listed with who may call it, and a test fails on a route nobody has decided.
API keys and rate limits
- API keys are shown once and stored only as a SHA-256 hash; each can be revoked.
- 120 calls a minute a key.
- Sign-in email checks (10 a minute an address), applications and password links are rate limited.
- Every reader's AI spend is held to a limit or to their prepaid credit.
Audit logs
- Every API call: when, which key, the route and the status — never the body.
- Every change to the desk's plans and journal: when, who, which records — never their content.
- Every agent run step: what it did, its status and what it cost.
Webhooks
- Signed with HMAC-SHA256 over the body (
X-Tibeb-Signature), with a secret shown once. - Sent only to https addresses on the public internet: private, loopback and link-local addresses are refused when a hook is registered and again when it is sent, and the request goes to the address that was checked.
The web
- HSTS,
nosniff, a strict referrer policy, and no framing by other sites. - An enforced Content Security Policy that forbids framing, plugins and a changed base address; a fuller policy runs in report-only mode while its reports are checked.
- Cross-site API calls are allowed only from Tibeb's own sites.
- Database and provider errors are recorded in fixed words, never their raw text.
Models, payments and your copy
- Anthropic's commercial terms for its API say it does not train its models on what customers send through the API. Tibeb does not claim a zero-data-retention arrangement.
- Stripe's webhook is refused unless Stripe's signature checks out.
- A nightly backup of each login's research data, kept 14 days; you can export everything yourself from the History panel, and ask for deletion by email.
If something goes wrong
If a breach affects your data, we will tell you after we confirm it. A firm that needs a set notice period, such as the 72 hours Regulation S-P asks of service providers, can have it written into its agreement.
Questions and questionnaires
A firm can ask for a security questionnaire, or report a problem, by writing to us.