Your portfolio says what you’re about to file.
A list of product codes and lifecycle stages is competitively sensitive by nature — it sketches a company’s regulatory roadmap. We treat it that way.
How your data is protected
- Every read is scoped to your verified identity. The browser never queries the database directly; each portfolio function derives who you are from your verified sign-in session and returns only your products. Your portfolio is never readable by another account, and isolation between accounts is covered by automated tests.
- No passwords. Sign-in is a one-time emailed link. There is no password to phish, reuse, or appear in a breach dump. Sessions are short-lived signed tokens, refreshed server-side.
- Encryption in transit. TLS on every connection, from your browser to the site and from the site to the database (hosted on Convex).
- No advertising trackers or pixels. Site analytics (Google Analytics 4) loads only if you accept the consent banner; decline, and the only third-party script left is Sentry error reporting (what failed and on which page; no cookies, no session recording). The only open-tracking we ever do is on our own digest emails, to know whether the product is worth your inbox.
- Ownership checks on every mutation. Adding, removing, or acting on a product verifies the session owns it — identity comes from the verified session, never from a form field.
What we store
Your email address, the product profiles you create (name, identifiers, lifecycle stage, optional manufacturer names), the matches our system computes against public FDA data, the state of your action items, and when you last opened your dashboard. To sign you in: your account and session records (signed session tokens, and one-time sign-in codes that expire within an hour). To stop abuse: a record of recent sign-up and sign-in-email attempts, keyed by your email address and by a one-way hash of your network address — never the address itself — deleted after a day. That is the complete list. See the privacy policy for the formal version.
Deleting your data
Removing a product deletes its matches and action history immediately — the cascade is enforced in the application’s single write path and covered by tests. Deleting your account removes your subscriber record, portfolio, sign-in records, and rate-limit entries for your address the same way. Email hello@regulatoryleadership.com and it happens.
What we don’t claim
FDA Radar is an early-stage product. We do not currently hold SOC 2 or ISO 27001 certification, and we won’t imply otherwise with a badge wall. If your procurement process needs specifics before then, write to us and we’ll answer directly.
Reporting a vulnerability
Security reports go to hello@regulatoryleadership.com. We read them first and answer fast, and we will credit you if you want credit.