Security

Security at Caipher

Caipher is made by Madigan Technologies LLC. Creators trust us with their brand emails, TikTok account and shop numbers, so we keep security simple, strict and honest. This page describes what we actually do today.

Your data stays yours

  • Only you can see your data. Every table in our database has row level security: a signed in creator can read and change only their own records. We test this by trying to read one account's data as another, across every table.
  • We collect only what a feature needs. Gmail access is read only, and Caipher reads your last 90 days when you connect. TikTok video lists are read live and never stored. Screenshots you add to read a product or your shop numbers are sent once and discarded; only the numbers or text you confirm are saved.
  • We never sell your data or use it for advertising. Caipher has no analytics or ad trackers.

Encryption

  • In transit: every connection between the app, our servers and our providers uses HTTPS (TLS).
  • At rest: our database and file storage are encrypted (AES-256) by our hosting provider, in the United States.
  • Your Gmail and TikTok access: the access Google and TikTok grant is kept only on our servers, encrypted with AES-256 using keys in a separate secure vault, in storage the app itself can't read.
  • On your phone: the Caipher 2.0 app keeps your sign in in the iOS Keychain. The app contains no secret keys.

Access

  • Only the founder can reach production systems.
  • Secret keys live only on our servers. Every app release is scanned for secrets before it's submitted.
  • Plans, usage limits and ownership are checked on our servers, never trusted from the app.

AI

Caipher's AI features run only after you agree to them. Requests go through our own server, which checks your account and limits, to Anthropic, our AI provider. Anthropic doesn't use them to train its models and deletes API data within 30 days.

Where your data lives

Caipher's database and files are hosted by Supabase on Amazon Web Services in Oregon, United States. Email is sent through Resend (United States). Requests travel through Cloudflare's and Supabase's global networks on the way.

How long we keep it

  • Synced email: only while Gmail is connected, and deleted within 30 days of disconnecting.
  • TikTok data: deleted when you disconnect, and within 30 days if TikTok access ends and you don't reconnect.
  • AI usage records (counts only): 12 months. Feedback: 24 months.
  • Delete your account and everything is deleted at once. A daily check removes anything left behind, so it's all gone within 30 days.

Your controls

  • See, change or delete what Caipher remembers about your shop in Settings, What Caipher knows.
  • Disconnect Gmail or TikTok at any time; disconnecting Gmail deletes Caipher's access at once and lets you delete your synced email.
  • Delete your account in Settings: we revoke Gmail and TikTok access and delete your data and files.
  • You can also remove Caipher's access in your Google or TikTok account settings.

Incidents

We have a written incident response plan. If an incident affects your personal data, we'll tell you by email without undue delay and within the time the law requires, and we notify our platform partners as their terms require.

In October 2026 we found that the first version of the app contained an AI service key that someone extracted and used to make AI requests billed to us. No personal data was exposed. We revoked the key, moved every AI request behind our own server, added spending limits and alerts, and now scan every release for secrets.

Report a security issue

Email support@madigantechnologies.com with "Security" in the subject. We respond as quickly as we can and fix confirmed issues on a set timeline.

Last updated October 12, 2026. Full details: the privacy policy.