Reporting a vulnerability
Email hello@thecompound.tech. Include the URL, what you did, and what you saw. There is no bounty and no NDA to sign. We will confirm receipt, and we will tell you what we changed.
The same address, with a machine-readable expiry, is published at /.well-known/security.txt under RFC 9116.
Accounts
PolicyDrift has no user accounts. There is nothing to sign in to, no password to reset and no session to steal, the site is a published dataset and a set of static pages, and a build gate fails the deploy if an authentication route ever appears while this page still says otherwise.
What is stored
- An email address, only if you type one into the checkout or the monitor form.
- Anonymous page analytics with the IP address truncated before it is stored.
- The URL you submit for a check, and the drift report it produced, so the report can be re-opened.
Who else processes data
| Processor | What it does with it | Its policy |
|---|---|---|
 Vercel | hosting and edge delivery, request logs | vercel.com |
 Supabase | the database this product's own reports are stored in | supabase.com |
 PostHog | product analytics, IP-truncated | posthog.com |
 Resend | delivering the report and monitor emails | resend.com |
 Stripe | payment, card details are entered on Stripe's own Checkout page and never reach this site | stripe.com |
Also true
- PolicyDrift reads what a page loads and what its policy says; it does not give legal advice and the corrected policy text it drafts is not a legal opinion.
- The whole estate runs on one Supabase project with row-level security on; this product's tables are its own.
PolicyDrift is built and run by Compound Labs. The declarations on this page are part of this product's own configuration and are re-checked at every deploy against the repository they describe: a product that claims to have no accounts and ships an authentication route fails the build, and so does one that takes payment without naming its payment processor here.