Security at PermitPal
Last Revised: October 2026
Sign companies and permit professionals trust PermitPal with project addresses, team accounts, and billing details. This page explains how we protect that information and how to reach us about a security concern.
Security Leadership
Security at PermitPal is led by Mustafa Abdelhamid, Co-founder, who is accountable for the security of our platform, infrastructure, and customer data. Security questions, vendor questionnaires, and vulnerability reports go directly to this function at support@permitpal.io.
Infrastructure and Encryption
- The PermitPal application runs on Amazon Web Services in the United States.
- Customer data is stored in managed AWS and Supabase databases and storage, encrypted at rest with provider-managed encryption.
- All traffic between your browser or API client and PermitPal is encrypted in transit over HTTPS.
- Uploaded files and generated reports are kept in private storage and shared through short-lived signed links.
Accounts and Access
- Sign-in is handled by Auth0. PermitPal never sees or stores your password.
- Team owners control who joins their team and what members can access.
- API keys are shown once at creation and stored only as a one-way hash, so a copy of our database cannot be used to call the API as you.
- Access to production systems is limited to the PermitPal personnel who need it to operate the service.
Payments
Payments are processed by Stripe. Card numbers go directly to Stripe and are never stored on PermitPal servers.
AI and Your Data
PermitPal uses AI models to read ordinances and answer questions about sign codes. These models run through business API providers listed below. We do not use your data to train AI models.
Subprocessors
| Provider | Purpose |
|---|---|
| Amazon Web Services | Application hosting, databases, file storage, email delivery |
| Supabase | Ordinance and reference data storage |
| Auth0 (Okta) | User sign-in and identity |
| Stripe | Payment processing |
| Microsoft Azure OpenAI | AI model inference and search embeddings |
| OpenRouter | AI model inference |
| PostHog | Product analytics |
Reporting a Vulnerability
If you believe you have found a security issue in PermitPal, email support@permitpal.io with the subject line "Security" and enough detail for us to reproduce it. We will acknowledge your report, keep you updated while we investigate, and credit you if you would like.
Please test only against your own account, do not access or change other customers' data, and give us a reasonable window to fix the issue before disclosing it publicly.
Security Reviews
We complete vendor security questionnaires for customers and prospects. Contact support@permitpal.io to start a review.