Infrastructure & Trust

All Chiller Tech Support LLC platforms — Torque CMS, Motorsports Data, Clutch DMS, and Riff OS — are designed, built, operated, and maintained by a single founder-operator based in Salt Lake City, Utah. There is no offshore development team, no rotating contractors with access to production systems, and no third-party agency with standing access to your data.

This is a deliberate architectural and operational decision. A smaller, tighter access perimeter means fewer vectors for exposure, faster incident response, and a single accountable party — the owner — for every system decision.

All platforms are deployed on Vercel — a globally distributed edge and serverless compute platform with SOC 2 Type II certification, automatic TLS provisioning, and DDoS mitigation at the edge. No platform runs on self-managed servers or shared hosting.

Primary database providers by platform:

• Torque CMS: Neon — serverless PostgreSQL with autoscaling, point-in-time recovery, and encryption at rest. Row-level security enforced at the database layer.
• Motorsports Data: Supabase — managed PostgreSQL with row-level security, real-time subscriptions, and encrypted storage.
• Clutch DMS: Neon — same stack as Torque CMS. Every query is scoped to the authenticated organization — no cross-org data access is possible at the query layer.
• Riff OS: Neon — same infrastructure pattern, deployed to match Clutch DMS.

File and media storage is handled by Vercel Blob with private-access defaults. No uploaded file is publicly accessible without an explicit signed URL generated at request time.

Authentication across Torque CMS, Clutch DMS, and Riff OS is handled by Better Auth — an open-source authentication library with built-in password hashing (bcrypt), session management, and CSRF protection. Passwords are never stored in plaintext. Sessions are server-side with rolling expiry.

Motorsports Data authentication is handled by Supabase Auth — email/password with bcrypt hashing, plus optional OAuth flows. Under-18 riders cannot create accounts directly. A parent or guardian must register and add the rider as a sub-profile, with explicit consent recorded at the point of creation.

Role-based access control (RBAC) is enforced at both the application layer and the database layer. A sales rep on Clutch DMS cannot read another organization's records regardless of any application-layer bypass — the database query will return nothing without a matching tenant ID.

Every platform is multi-tenant. Isolation is enforced at three layers simultaneously:

• Row-level security (Supabase): Supabase platforms enforce RLS policies at the PostgreSQL layer. Queries run as the authenticated user — not as a superuser — and can only return rows where the policy condition is met.
• Per-query org scoping (Neon/Better Auth): Every query on Neon-backed platforms includes an explicit WHERE org_id = $session_org_id clause derived from the authenticated session. There is no global query path that bypasses this scoping.
• Session-bound API routes: Every API route and server action verifies session identity before touching the database. Unauthenticated requests are rejected at the route handler, before any database call is made.

Your organization's data is never mixed with, visible to, or queryable by any other organization on the same platform.

• In transit: All traffic between clients and our platforms is encrypted with TLS 1.2+ enforced at the edge (Vercel). HTTP requests are automatically redirected to HTTPS. There is no unencrypted HTTP path to any production endpoint.
• At rest: All database storage on Neon and Supabase is encrypted at rest using AES-256. File storage on Vercel Blob is encrypted at rest.
• Passwords: Hashed with bcrypt (cost factor 12) via Better Auth or Supabase Auth. We never store, log, or transmit plaintext passwords.
• Secrets management: API keys, database credentials, and service tokens are stored as encrypted environment variables in Vercel. No secrets are hardcoded in source code or committed to version control.

Every response from our platforms includes the following HTTP security headers:

• Strict-Transport-Security (HSTS): max-age=63072000; includeSubDomains; preload — forces HTTPS for 2 years including all subdomains.
• X-Frame-Options: DENY — prevents clickjacking by blocking our pages from being embedded in frames.
• X-Content-Type-Options: nosniff — prevents MIME-type sniffing attacks.
• Referrer-Policy: strict-origin-when-cross-origin — limits referrer data sent to third parties.
• Permissions-Policy — disables camera, microphone, and geolocation access from our pages by default.
• Content-Security-Policy (CSP): Restricts script, style, image, and connect sources to known-good origins. Inline scripts are disallowed except where explicitly required by the framework.

AI co-pilot features across all platforms are powered by the Vercel AI Gateway, which routes to foundation models from Anthropic (Claude) and Google (Gemini) depending on the platform and use case.

What is sent to AI providers:The content of your co-pilot query, relevant context constructed by our system (e.g., equipment context, session metadata), and a system prompt written by Chiller Tech Support LLC. We do not send your full database records, other users' data, or organizational financial data to AI providers unless you explicitly include it in your message.

What is not sent: Passwords, payment card data, authentication tokens, or any data outside the context window we construct for the specific request.

Training opt-out:By default, interactions with our AI co-pilot may be used to fine-tune our own models. You may opt out at any time by contacting us. Third-party AI providers (Anthropic, Google) operate under their own data use policies — queries routed through the Vercel AI Gateway are subject to those providers' enterprise API terms, which generally prohibit using API inputs for model training without consent.

All payment processing is handled by Square. Chiller Tech Support LLC does not store, transmit, or log full payment card numbers. We retain:

• Transaction ID and amount
• Subscription tier and billing period
• Last four digits and card brand (for display in the customer portal)
• Billing address as provided

Square is PCI DSS Level 1 certified. All card data is tokenized at the point of entry in Square's hosted payment UI before it reaches our servers.

Live uptime for all domains is monitored continuously and reported publicly at chillertechsupport.com/status. We do not hide downtime or maintenance.

In the event of a confirmed security incident affecting customer data, we commit to:

• Notifying affected customers within 72 hours of confirmation — faster where legally required.
• Publishing a post-mortem publicly on the blog within 7 days of resolution.
• Providing a clear description of what data was affected, how, and what remediation steps were taken.

We have no SLA on response time yet — we are an early-stage company with a single operator. What we do have is a direct line to the founder, a public status page, and a commitment to never hide or downplay an issue.

The following vendors have access to production infrastructure or customer data as part of normal platform operation:

• Vercel — compute, edge, deployment, blob storage, AI gateway. SOC 2 Type II.
• Neon — PostgreSQL database for Torque CMS, Clutch DMS, Riff OS. SOC 2 Type II.
• Supabase — PostgreSQL database and auth for Motorsports Data. SOC 2 Type II.
• Square — payment processing. PCI DSS Level 1.
• Anthropic / Google DeepMind — AI model inference via the Vercel AI Gateway. Enterprise API terms apply.

No other vendor has standing access to production systems or customer data. We do not use analytics platforms (e.g., Google Analytics, Mixpanel, Segment) that embed third-party tracking scripts on customer-facing pages.

Our platforms are built on open-source foundations: Next.js, React, Tailwind CSS, Drizzle ORM, Better Auth, and the Vercel AI SDK. We believe in building on auditable, community-reviewed code rather than proprietary black boxes.

We do not currently publish our application source code publicly, but we do not obscure our technology choices. The stack described in this document is the stack in production — no hidden layers, no undisclosed dependencies.

• Sell your data to third parties — ever.
• Use your organizational data to train AI models on behalf of any other organization.
• Grant access to your data to any employee, contractor, or vendor not listed in the Vendor section above without your explicit written consent.
• Hide or downplay a security incident, outage, or data breach.
• Change this commitment without 30 days public notice and the ability for you to export and delete your data before the change takes effect.

Security vulnerability disclosures, infrastructure questions, and trust-related inquiries can be submitted via our contact page or directly via torquecms.io/contact. We will respond to all security disclosures within 48 hours. We do not have a bug bounty program at this time but we do publicly acknowledge researchers who responsibly disclose valid vulnerabilities.