Security

This page describes the security controls GetPRBoost actually applies, verifiable against the code and configuration in this repository. We do not hold SOC 2, ISO 27001, or any other third-party certification, and we make no uptime guarantees on this page.

• Security headers on every page

  Every response from getprboost.com carries a Content Security Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and a strict Referrer-Policy. Inline JavaScript execution is blocked by the CSP. These rules are declared in public/_headers and applied by Cloudflare Pages. The one exception is the newsroom embed (/newsroom/<slug>/embed), which is deliberately framable so customers can place it on their own site; it is public, session-free and carries no form.

• Payments processed by Stripe

  Card details are entered directly on Stripe-hosted fields and never transmitted to or stored on GetPRBoost servers. We receive only a Stripe payment-intent ID and a billing status.

• Data stored in Supabase Postgres with row-level security

  Customer records, orders, and placement data are stored in a Supabase Postgres database. Row-level security policies are enforced at the database layer, restricting each organization to its own rows.

• Human staff approval before distribution

  Every press release is reviewed and explicitly approved by a staff member before it is sent for distribution. No release is dispatched automatically.

• HTTPS everywhere

  The site is served exclusively over HTTPS. Cloudflare enforces HTTPS at the edge; plain HTTP requests are redirected.

To report a security issue, email support@getprboost.com.