Security
Last updated /
What we actually do to protect your site, your account and your visitors' messages, and how to report a problem.
The short version
This page describes how Nexus Media LLC dba FirstGen protects the information on firstgen.dev, in the app and dashboard at app.firstgen.dev, and on the sites we host. We're a small team, so we lean on providers that do security for a living and keep our own part simple. We'd rather tell you exactly what we do than make claims we can't show. We don't hold a SOC 2 report today.
Everything travels over HTTPS, including every site we host and every custom domain.
There are no passwords. You sign in with a one-time code or link sent to your email.
Each customer's rows are fenced at the database with row-level security.
Our staff tools are limited to a short list of named team members.
Stripe holds every card detail. We never see a full card number.
Our database runs on Supabase and our sites run on Vercel, with backups taken by the provider.
Found a problem? Email support@firstgen.dev.
Where your data lives
Database and sign-in: Supabase. Region: United States.
Website (firstgen.dev), app (app.firstgen.dev) and hosted sites: Vercel. Region: United States.
DNS and the proxy in front of firstgen.site: Cloudflare. Region: Global network.
Payments, invoices, cards: Stripe. Region: United States.
Email we send: Resend. Region: United States.
The other providers we use, and what each receives, are listed in the Privacy Policy (firstgen.dev/legal/privacy). Your domain stays with the company you bought it from. We never ask for your registrar login.
Encryption
In transit: the website, the app, the dashboard and every hosted site only load over HTTPS (TLS), and so do our calls to every provider.
Custom domains: a certificate is issued for your domain automatically once its DNS points to us.
Database at rest: the provider encrypts the database and its backups at rest.
Sign-in: one-time codes and links expire, and the session that follows is a signed token, not a password.
Who can reach what
Row-level security. Tables that hold customer data have policies at the database that only return the signed-in customer's own rows. A bug in the app can't hand one customer another customer's site.
Your account. One owner login per site, tied to the email you checked out with.
Staff access. Our team reaches customer sites through an admin console open only to a fixed list of staff email addresses. We open a customer's data to build or fix a site, answer a support request, or handle billing.
Provider accounts. Our Supabase, Vercel, Cloudflare, Stripe and Resend accounts are limited to the people who need them.
Payments
Checkout runs on Stripe's own checkout page, so card details go from your browser to Stripe. Our servers receive a customer reference and the status of your subscription. Stripe is a PCI DSS Level 1 service provider. Refunds are made by a person at FirstGen, through Stripe.
Backups and availability
The database is backed up by Supabase on its schedule, encrypted. Sites and the app are served by Vercel from several locations, and addresses on firstgen.site pass through Cloudflare first. If your site is down for more than a short while, we'll tell you what happened and what we changed.
Signing in
You sign in with the email you checked out with. We send a 6-digit code and a link, and either one works once.
Only an email that belongs to a customer can sign in. Nobody can create an account from the sign-in page.
Sign out from the dashboard at any time. Tell us if you lose access to your inbox and we'll help you move the account.
How we build
Every change gets a preview deployment before it reaches production.
Secrets live in the host's environment settings and are never committed to code.
Scheduled jobs and webhooks check a shared secret, and Stripe webhooks are signature-checked.
The site editor can only change content fields. It can't change code, layout, the domain or billing.
Every input is validated on the server, and contact forms have a spam trap.
If something goes wrong
If we confirm a breach that affects customer data, we fix the cause, tell the customers affected within 72 hours of confirming it, as the Data Processing Addendum (firstgen.dev/legal/dpa) promises, and meet the notice rules in the law. If it affects people who aren't customers, we tell them too. We write down what happened and what we changed.
Reporting a security problem
If you find a security problem on firstgen.dev, in the app, or on a site we host, email support@firstgen.dev with what you found, the steps to reproduce it, and how to reach you. We reply within two business days, keep you posted while we fix it, and credit you if you'd like.
Please give us a fair chance to fix it before telling anyone else.
Don't access, change or delete other people's data, disrupt the service, or test with real customers' information.
Stop and tell us as soon as you've shown the problem exists.
We won't take legal action against anyone who reports in good faith and follows these rules.
We don't run a paid bug bounty program today.
Certifications and reviews
FirstGen doesn't hold a SOC 2 report today. For the current details of each provider's own certifications, ask us at support@firstgen.dev. We'll update this page if any of that changes.
Nexus Media LLC dba FirstGen, 18948 Stonebluff Lane, Noblesville, IN 46062. Security questions: support@firstgen.dev.
