Security
Built like the number it protects.
If SlabX is going to tell you what your collection is worth, it has to be careful with what it knows about you. This page lists what we actually do today, not what we plan to do.
What we do
Eight commitments, all shipping
Your collection stays on your device
Cards, quantities, cost basis, notes, price history, and value snapshots live in a local database on your phone. They are not uploaded. Deleting the app deletes them.
Scans are not stored
A downscaled photo is sent once to the identification service to read the card, then discarded. SlabX keeps no photo of your cards or your slabs.
Encrypted in transit
Every connection uses TLS. On iOS, App Transport Security is enforced with no exceptions for arbitrary loads.
Sessions encrypted at rest
Your sign-in session is encrypted on the device with a 256-bit AES key held in the iOS Keychain or Android Keystore. Without that key the stored session is unreadable.
Row-level security on every table
The account database enforces row-level security: you can only read and change your own profile, posts, and likes, and the policies are in the schema, not in app code.
Keys stay on the server
In production, price lookups, AI identification, and PSA verification run through our own server functions. Third-party API keys are never shipped inside the app.
Payments handled by the stores
Subscriptions are billed by the Apple App Store and Google Play. SlabX never sees or stores a card number.
No trackers, no ad SDKs
There is no advertising SDK, no cross-app tracking, and no advertising identifier collection in the app. Product analytics are off in the current build.
Your control
Export, delete, and ask
- Export your whole collection as CSV from Settings at any time.
- Delete your account from Settings. Profile and Community content go immediately; remaining server data is removed within 30 days.
- Ask what we hold about you. Email support@getslabx.com from your account address and we answer within 30 days.
Responsible disclosure
Found something?
If you believe you have found a security issue in the app, the site, or our server functions, tell us before you tell anyone else.
Email support@getslabx.com with the subject “Security report”, the steps to reproduce, and how to reach you. We acknowledge reports within two business days, keep you updated while we fix the issue, and credit you if you want credit. We ask that you avoid accessing other people's data and give us reasonable time to fix before publishing.
What we do not claim: SlabX has not completed a third-party audit or a SOC 2 report. When that changes, it will be listed here. Read the full privacy policy for what is collected and why.