This guide is the chatbot-readable reference for the public Security page. Use it for questions about data safety, privacy, permissions, public forms, exports, and who can see an organization's records.
Who Owns the Data?
The organization does. Pet records, applicant answers, medical notes, documents, donors, volunteers, payment settings, and team context are the organization's operational data, not an advertising asset.
Rescue teams decide what to collect in applications, forms, pet records, notes, documents, donations, and volunteer workflows. PawPlacer provides the tools and access controls for that content.
Is the Data Sold or Used for Ads?
No. PawPlacer does not sell user data, does not share it, does not broker it, and does not use it for advertising or third-party marketing. PawPlacer does not serve ads inside the product.
PawPlacer's own account data collection is minimal: an email address for login, with names optional.
How Organizations Are Kept Separate
Workspace records, documents, payments, people, and pet data are tied to the organization that owns them. Another organization cannot reach private workspace data by changing a link, filter, form, or request.
Access is checked close to the data. PawPlacer does not rely only on which buttons are visible in the browser: sensitive reads and changes are checked on the server and in the database before private data is returned or modified. Account-scoped top-level database functions verify account access before reading or writing tenant data, and public or auth-optional flows use explicit helpers rather than silently trusting an anonymous request.
Team Permissions
Owners decide who manages pets, people, reports, API keys, team access, and administrative settings. Higher-risk actions have separate checks rather than one broad all-or-nothing permission.
Public Forms, Listings, and Uploads
Applications, donations, volunteer forms, surrender forms, and uploads can be public, so they get extra validation before PawPlacer accepts information from outside the workspace:
- Submissions verify the account, table, template, and enabled-form state before data is accepted.
- Rate limits apply per IP and per account to reduce spam and automated abuse.
- Uploads must be tied to an enabled public form and pass file type, size, and path checks, and they are written under account-scoped prefixes rather than caller-provided paths.
- Deletes validate ownership with account-scoped path checks and reject traversal, null bytes, and malformed references.
- Public adoption and donation flows use tokenized or scoped server endpoints rather than exposing private workspace data.
- Public pet listings are separated from private records and expose only public-facing pet information.
Public pet listings, forms, widgets, and donation pages are public because an organization chose to publish them. Private applications, foster notes, surrender narratives, internal comments, documents, and files are not.
Payments
Payments run through the processors the organization chooses. PawPlacer does not handle card data directly, and it does not take a cut of donations or adoption fees.
Optional AI Features
Organization-level AI features start turned off unless enabled. When enabled, only the data needed for that workflow is sent to OpenAI, and AI calls stay behind authenticated, CSRF-protected server routes. AI matching is unavailable in GDPR-restricted regions, and OpenAI API data is not used to train models by default.
Exports and Portability
Exports and account access are available to every organization. Data exports in CSV format are available whenever and as often as an organization wants, and pet, adopter, foster, adoption fee, contract, and custom field data can also be retrieved through the first-party SDK and REST API.
Subprocessors
PawPlacer discloses data only to the subprocessors needed to operate the service: Supabase, Vercel, Stripe, Resend, Google Maps, and OpenAI when optional AI features are enabled.
How Security Is Reviewed
Security review is built into how PawPlacer is built, and new work is audited against the real risks in this product: tenant boundaries, public submissions, payment configuration, API access, files, documents, and role permissions. Database tests cover account access, role checks, public and auth-optional paths, and cross-account isolation, so authorization behavior is exercised close to the data.
Reviews cover account scoping in frontend, server, and SQL changes; database functions for access assertions, explicit volatility, safe search paths, deterministic list behavior, soft-delete filters, and careful use of SECURITY DEFINER; every route that accepts unauthenticated traffic; and framework, Supabase, payment, email, storage, and AI integration changes as the app evolves.
Logs and API responses are designed to avoid leaking secrets such as tokens, passwords, API keys, CSRF values, sessions, and auth codes.
Shared Responsibility
Security also depends on how each organization configures PawPlacer: who has owner access, which public forms are enabled, where API keys are stored, which payment methods are connected, and whether optional AI features are turned on. Those controls are visible in the app, and the team is happy to review a real workflow before launch. Email contact@pawplacer.com or use the public contact form.