Trust & Security
Perfotix AI is built on secure defaults, official API integrations, and conservative data practices. Your brand data, prompts, and workspace credentials are protected at every layer.
Live scoring connects to ChatGPT, Gemini, and Claude through official OpenAI, Google, and Anthropic APIs - not scraping, automation hacks, or brittle workarounds. This ensures stable, terms-compliant, and reproducible results.
All dashboard routes require authentication. Sessions are signed with HMAC-SHA256, stored as HTTP-only cookies, and expire after seven days. Passwords are hashed using scrypt with per-user salts - never stored in plaintext.
API keys, payment credentials, database URLs, and signing secrets are stored exclusively in server environment variables. They are never exposed to the browser, never committed to version control, and never included in client bundles.
All server actions and API routes validate inputs through strict Zod schemas before processing - field types, lengths, URL formats, and enum values are enforced at the boundary.
Checkout and subscription billing are handled entirely by Paddle, our merchant of record. Card details never touch Perfotix AI servers. Payment webhooks are signature-verified on every event before any access status is updated.
Every page response includes X-Frame-Options, X-Content-Type-Options, Strict-Transport-Security (HSTS), Referrer-Policy, and Permissions-Policy headers to protect users against common web vulnerabilities.