Security

Threeworld is a read-only layer over other platforms. We never hold money, never take card details, and never ask for your login to any investment platform. The most sensitive thing in our database is your email address and your chat history with the assistant. That is by design: the less we hold, the less there is to protect.

• Encryption in transit. Every connection to threeworld.xyz and to our API uses TLS, and we send HSTS so browsers refuse to connect any other way.
• Passwords never touch us. Sign-in is handled by Clerk. Passwords, one-time codes and Google sign-in all live in their system, not ours.
• Secret scanning on every commit. Every change to our code is scanned for leaked credentials before it can be committed, and our CI scans the full history on every pull request.
• Least access. Production systems are reachable only by the founding team, and only over provider accounts, never by shared credentials.
• Security headers. Strict transport security, no MIME sniffing, referrer trimming and frame protection are set on every response. Check them yourself with the scanners below.

We run on a small number of providers. Each processes data on our behalf under its own security program, and several hold certifications we don't hold ourselves yet:

• Clerk: Sign-in and account storage.
• Railway: Servers and database hosting.
• OpenRouter: Routes assistant messages to the AI model that answers.
• Mapbox: Map tiles for the Explore globe.
• Google Analytics: Page-view analytics, only after you accept the cookie prompt.

Straight answer: Threeworld does not yet hold a SOC 2 report or an ISO 27001 certificate of its own. We are a small team and we would rather say that plainly than put a borrowed badge in the footer. Our hosting and authentication providers publish their own reports at the links above. If your organization needs a security questionnaire filled in, email owklamaa@gmail.com and we will answer it.

Both of these run live against threeworld.xyz, so what you see is what is true today:

• SSL Labs: TLS configuration.
• Mozilla Observatory: HTTP security headers.

Tell us. Email owklamaa@gmail.com with what you found and how to reproduce it. The same address is published at /.well-known/security.txt. We aim to acknowledge reports within three business days and to tell you when the issue is fixed.

We support good-faith research. If you stay within these lines we will not take legal action against you:

• Don't access, change or delete data that isn't yours.
• Don't degrade the service for others (no denial of service, no spam).
• Give us a reasonable time to fix the issue before talking about it publicly.

We don't run a paid bounty program today. We do say thank you, publicly if you like.

What we collect and why is in the privacy policy. The rules for using the site are in the terms.