Security

This page describes how MBA Copilot protects your data. It lists only what is actually in place today, stated plainly. Application essays and career histories are sensitive, and you deserve a straight answer about how they are handled. For what we collect and why, see the Privacy policy.

Payments run on Stripe-hosted Checkout and the Stripe Customer Portal. Your card details go directly to Stripe and never touch our servers. We store no card numbers, and we do not rebuild any payment forms of our own.

• Every table holding user data enforces per-user row-level security in the database itself: a request authenticated as you can only read and write rows that belong to you.
• Admin-privileged database access is confined to two server routes, the billing webhook and account lifecycle (deletion), and each one scopes every statement to an explicit account id.

Every connection to MBA Copilot is encrypted in transit with TLS. Data is encrypted at rest by our infrastructure providers (Vercel and Supabase).

The product’s guidance is generated by the AI service providers named in our Privacy policy, under terms that prohibit those providers from using your data to train their models.

You can export a copy of your data and delete your account yourself, at any time, from Settings → Privacy & data. Deletion removes your account and the data attached to it; no email to support is required.

If you find a security issue, email rishabh@mbacopilot.com, the same contact published in our security.txt. Please include enough detail to reproduce the issue, and give us a reasonable window to fix it before sharing it publicly.

What to expect: we will acknowledge your report and follow up once the issue is resolved. We do not run a bug bounty or reward program. There is no payment for reports, and we would rather say that here than let you find out after the work.

MBA Copilot is an early-stage product built by a small team. We have not completed a SOC 2 or ISO 27001 certification, and we have not commissioned an independent penetration test. We would rather leave those unclaimed than imply an audit that has not happened; this page will change when that does.

Questions about security? Email rishabh@mbacopilot.com.