Security

Your deals, contracts and money are yours. Here is exactly how they stay that way.

Last updated September 16, 2026. Written without the security-vendor voice, on purpose. Every line below is something you can check or ask us to show you. Questions: support@rostrlab.com.

The short version

Your account is its own sealed file. One account, one file, in private storage that nothing public can reach. No other customer's account can see it, and neither can a search engine.
Encrypted in transit and at rest. Everything moves over HTTPS only. The storage provider encrypts every file at rest.
No passwords to leak. You sign in with a link sent to your email. It works once and dies after 20 minutes. Sign out everywhere, on any device, from Setup.
We never see a card number. Stripe holds cards and pays out. RostrLab only learns that a payment happened.
Your email only signs you in. Never sold, never shared, never on a list. No ad networks, no tracking pixels, no third-party analytics.
No investors, no team with access. One person runs this, reads an account only when you send a ticket asking for a fix, and answers to you.

Signing in

There is no password anywhere in RostrLab, so there is no password to guess, reuse or leak. Type your email, tap the link we send. Each link is single-use and expires in 20 minutes; a link that has been used cannot be replayed. Your session is a secure, HTTP-only cookie the browser will not hand to scripts. "Sign out everywhere" in Setup revokes every session on every device at once, including any link still sitting in an inbox.

Where your data lives

Each account is a single private record in Vercel Blob storage, encrypted at rest by the provider and readable only by RostrLab itself, signed in as you. Contracts, receipts and screenshots you add go into the same private store and are served only to you, signed in. The only things that are public are the things you publish on purpose: your media kit, and your profile photo on it.

Keys and connections

When a company connects a data provider with its own key, the key is encrypted with AES-256-GCM before it is stored, is never displayed again, and is used only to make the lookups you ask for. Disconnect it and it is gone.

Money

Payments run on Stripe. Your subscription, and the Pay links brands use to pay you, are Stripe pages. Card numbers never touch RostrLab. When a brand pays, we learn the invoice was paid and mark it for you; that is all.

Reading contracts and emails

When RostrLab reads a contract or a brand email for you, the text is sent to Anthropic's API to do the read, under terms that do not use it for training, and the result comes back to your account. Nothing is kept there. Brand mail forwarded to your RostrLab address arrives through Resend and then lives only in your account. Receipts that become expenses follow the same path.

What we do not do

Sell, rent or share your data with anyone. Not brands, not advertisers, not other creators, not other companies.
Use your deals, contracts or numbers to train anything.
Show ads, run tracking pixels, or load third-party analytics. Page views are counted first-party, with no personal data attached.
Read your account by hand unless you have sent a ticket asking for a change, and then only for that change.
Keep anything after you leave. Ask, and your account and every file in it are deleted within 30 days. Until then you can export everything from Taxes in one click.

The demo

The demos at creator.rostrlab.com and company.rostrlab.com run in memory. Nothing you click there is saved, nothing is sent, and no one else sees it.

If something goes wrong

If we ever learn of a breach affecting your account, you hear from us by email within 72 hours with what happened, what it touched, and what we did. Report anything that looks wrong to support@rostrlab.com; it is read the same day.