Security
Built like a vault, calm like a notebook.
The Founders App holds your most private business thinking. We take that seriously: your data is isolated by account, hashed with modern standards, and guarded against automated guessing.
PBKDF2-hashed PIN
Your four-digit PIN is never stored as plain text. We use PBKDF2 with 100,000 iterations and a unique random salt per account, so even if two people choose the same PIN their hashes are completely different.
Brute-force lockout
After five failed PIN attempts the app pauses for five minutes. Every incorrect guess also adds a short server-side delay, making automated guessing impractical.
Row-level access control
Every database request is authenticated and scoped to your user ID. The rules are enforced by the database itself, so one account cannot read another's businesses, entries, journal or contacts.
No ads, no data resale
We do not sell your data, share it with advertisers, or use your entries to train models. Analytics, where used, are aggregate and never include entry content.
Encrypted in transit
All traffic between your device and our backend uses TLS. Account credentials and session tokens are handled by the same authentication infrastructure we use for sign-in.
What we do not do
- —We do not store your PIN in plain text or reversible encryption.
- —We do not allow unlimited PIN guesses — the lockout slows and then stops attempts.
- —We do not let staff or admins read your entries. Even the site admin sees only aggregate counts and billing metadata, never business content.
- —We do not share your contacts, journal or daily entries with third parties.
Responsible disclosure
If you find a security issue, please tell us before disclosing it publicly. We will investigate quickly and keep you informed. Reach us through the contact details on the FAQ page.