Security

Security is fundamental to Frqcy. This page describes the controls that are currently in place to protect your account, your uploaded audio, and your analysis results. It is maintained by Noirmusicshop LLC to answer common security questions and reflects the practices of the platform as operated today.

This page describes current practices and is not a certification or independent audit. Security is a shared responsibility: we secure the platform, and you are responsible for safeguarding your credentials and the content you upload.

• Accounts are protected by managed authentication with securely hashed credentials; we never store your password in plain text.
• Sessions use signed tokens, and sensitive actions require an authenticated session.
• Each account can access only its own reports and data — enforced at the database level, not just in the interface.
• Administrative capabilities are restricted to authorized roles stored separately from user profiles to prevent privilege escalation.

User data is protected by row-level security policies in our database. These policies ensure that queries return only the records that belong to the authenticated user, so one user cannot read, modify, or delete another user's reports or uploads.

• Data transmitted between your browser and the Service is encrypted in transit using industry-standard TLS (HTTPS).
• Data at rest is stored on managed infrastructure that provides encryption at rest.
• Payment card data is handled directly by our PCI-compliant payment processor; we do not receive or store full card numbers.

The Service runs on managed cloud infrastructure (Lovable Cloud, built on Supabase for database, authentication, and storage, with server-side logic executed in an isolated serverless runtime). We rely on these providers' physical, network, and platform security controls, and we limit the data and privileges available to each component of the system.

Audio you upload is processed to produce your requested analysis and is associated only with your account. You can delete individual reports at any time from within the Service. We do not make your uploads publicly accessible, and we do not use your audio to train models for other customers without your explicit consent.

• Secrets and API keys are stored as protected server-side environment variables and are never exposed to the browser.
• Server-side logic validates input and enforces authorization before performing sensitive operations.
• We apply the principle of least privilege to system components and third-party integrations.
• We monitor for errors and abuse and apply security-relevant updates to our dependencies and platform.

• Use a strong, unique password and keep your credentials confidential.
• Sign out on shared devices and review account activity periodically.
• Only upload audio you are authorized to submit.
• Notify us immediately if you suspect unauthorized access to your account.

We welcome reports from security researchers. If you believe you have found a vulnerability, please email info@noirmusic.shop with details and steps to reproduce. Please give us a reasonable opportunity to investigate and remediate before public disclosure, and avoid accessing or modifying data that is not yours. We appreciate good-faith research and will not pursue action against researchers who follow this guideline.

If we become aware of a security incident affecting your personal data, we will investigate, take steps to contain and remediate it, and notify affected users and authorities as required by applicable law.

For any security question or report, contact Noirmusicshop LLC at info@noirmusic.shop.