Security
What CardChase stores, who else processes it, and how to report a vulnerability.
Reporting a vulnerability
Email hello@thecompound.tech. Include the URL, what you did, and what you saw. There is no bounty and no NDA to sign. We will confirm receipt, and we will tell you what we changed.
The same address, with a machine-readable expiry, is published at /.well-known/security.txt under RFC 9116.
Accounts
CardChase has user accounts. What is stored against one, and who else touches it, is below.
What is stored
- Your account: the email address you sign in with, and the Stripe account you connect
- The failed charges the agent reads, the retries it proposes and the emails it drafts — and every decision you make on them, because that record is what makes the kill window provable rather than asserted
- Your customers' billing contact details, because a dunning email has to go somewhere
- Anonymous usage analytics — page views and clicks. Form inputs are masked in session recordings
Who else processes data
- Stripe — reads the failed charges and runs the retries you approve, and takes your own subscription payment — we never see a card number
- Supabase — authentication and the database holding your subscriptions, retries and decision history
- Resend — delivers the dunning emails you approved
- PostHog — anonymous product analytics, proxied through this domain
- Vercel — serves this site and holds its access logs
Also true
- The plans are PRO at $9/month. Your card is charged when you subscribe, and cancelling inside the product stops the next charge. There is no trial and no free plan; the live demo at https://cardchase.thecompound.tech/demo needs no account and no card.
- No retry is attempted and no email is sent without you approving that specific one first. Approval is per action, not a setting you turn on once.
- Every action the agent takes is written to an append-only ledger with the evidence it acted on, including the ones nobody looks at. That record is what makes the kill window provable rather than asserted.
- There is no password on this product. Sign-in is a link sent to your email address, so there is nothing to reuse, leak or reset badly.
- Your data is scoped to your organisation at the database level, not only in the interface.
CardChase is built and run by Compound Labs. The declarations on this page are part of this product's own configuration and are re-checked at every deploy against the repository they describe: a product that claims to have no accounts and ships an authentication route fails the build, and so does one that takes payment without naming its payment processor here.
This page is https://cardchase.thecompound.tech/security, word for word, captured 2026-09-13.