Security at Stack Cost AI.

Our security model.

Stack Cost AI is a static website made up of prebuilt files served by a hosting provider. There is no login system, no server side application processing your input, and no database storing user records.

That's intentional. Many common web security risks, such as stolen credential databases, injection attacks against user data, and session hijacking, simply don't have anything to target here. The best way to protect sensitive data is not to collect it in the first place.

Where your data lives.

Every estimate you build is calculated directly in your browser, and your provider selections are stored only in your browser's local storage. They are never sent to our servers.

• The site is served over HTTPS.
• Private or incognito windows do not permanently save your selections.
• Selecting "Clear all" on the My Summary page immediately removes your saved selections.

Our third party surface.

Every third party script a website loads, including analytics, advertising, chat tools, and session recording, can introduce additional security and supply chain risks. We keep that surface as small as possible.

Our external services are limited to:

• A static hosting provider that serves the website over HTTPS.
• Google Fonts, which provides the Inter and JetBrains Mono typefaces.

There are also no application secrets to expose. Because Stack Cost AI is a static website, it does not require API keys, tokens, or credentials to function.

Report a vulnerability.

Found a security issue? We'd genuinely like to hear about it. Email us athello@stackcostai.com with as much detail as possible, including what you found, how you found it, and how we can reproduce the issue.

A few requests:

• Give us reasonable time to investigate and fix the issue before making it public.
• Don't run denial of service or spam tests against the site.
• Don't intentionally degrade the experience for other visitors while researching.

In return, we'll acknowledge your report, investigate it properly, fix genuine issues promptly, and credit you publicly if you'd like. We don't currently operate a paid bug bounty program. We'd rather be straightforward about that than present a simple thank you as a reward.

Ongoing practices.

A small attack surface is not an excuse to become complacent. We continue to:

• Keep dependencies updated and regularly rebuild from source.
• Review every new external resource before adding it, with "don't add it" as the default.
• Collect as little data as possible, because minimizing the data you hold is one of the simplest security controls available.