Security

Built like the number it protects.

If SlabX is going to tell you what your collection is worth, it has to be careful with what it knows about you. This page lists what we actually do today, not what we plan to do.

What we do

Nine commitments, all shipping

  • Your collection stays on your device

    Cards, quantities, cost basis, notes, price history, and value snapshots live in a local database on your phone. They are not uploaded. Deleting the app deletes them.

  • Scans are not stored

    A downscaled photo is sent once to the identification service to read the card, then discarded. SlabX keeps no photo of your cards or your slabs.

  • Encrypted in transit

    Every connection uses TLS. On iOS, App Transport Security is enforced with no exceptions for arbitrary loads.

  • Sessions encrypted at rest

    Your sign-in session is encrypted on the device with a 256-bit AES key held in the iOS Keychain or Android Keystore. Without that key the stored session is unreadable.

  • Row-level security on every table

    The account database enforces row-level security: you can only read and change your own profile, posts, and likes, and the policies are in the schema, not in app code.

  • Keys stay on the server

    In production, price lookups, AI identification, and PSA verification run through our own server functions. Third-party API keys are never shipped inside the app.

  • Payments handled by the stores and by Stripe

    Subscriptions are billed by the Apple App Store, Google Play, or Stripe on the web. Marketplace orders run on Stripe: the buyer pays SlabX, the money is held until the carrier confirms delivery, and the seller is paid to their own Stripe Express account. SlabX never sees or stores a card number and never holds seller funds after release.

  • Identity checks stay with Stripe

    Members who choose to verify their identity do it on Stripe Identity's pages: a government ID and a matching selfie. SlabX stores only whether it passed, when, and Stripe's session reference. The document images never reach SlabX. Shipping labels are issued through Shippo, which sees the two addresses and the parcel, nothing else.

  • No ad trackers, no ad SDKs

    There is no advertising SDK, no cross-app tracking, and no advertising identifier collection in the app. Product analytics are off in the current build. This website uses Google Analytics for page traffic only, with advertising features off and IP addresses truncated; the privacy policy says exactly what it records.

Your control

Export, delete, and ask

  • Export your whole collection as CSV from Settings at any time.
  • Delete your account from Settings. Profile and Community content go immediately; remaining server data is removed within 30 days.
  • Ask what we hold about you. Email support@getslabx.com from your account address and we answer within 30 days.

Responsible disclosure

Found something?

If you believe you have found a security issue in the app, the site, or our server functions, tell us before you tell anyone else.

Email support@getslabx.com with the subject “Security report”, the steps to reproduce, and how to reach you. We acknowledge reports within two business days, keep you updated while we fix the issue, and credit you if you want credit. We ask that you avoid accessing other people's data and give us reasonable time to fix before publishing.

What we do not claim: SlabX has not completed a third-party audit or a SOC 2 report. When that changes, it will be listed here. Read the full privacy policy for what is collected and why.