Trust & security

The real controls behind every payment.

Maintained by AirInk and describing what is in place today. Not an audit, not a certification.

Controls

Concrete, not aspirational.

Stripe processes payments

Payments flow through Stripe, a licensed money transmitter. AirInk never holds customer funds.

Stripe Identity KYC

Document and selfie verification before the first payout to anyone who gets paid. ID data stays with Stripe.

MFA on releases

Two-factor is available everywhere and required for payout-sensitive actions.

Breach screening

New passwords are checked against Have I Been Pwned and rejected if compromised.

Row-level security

Every user-owned table is scoped to its owner, enforced database-side.

Signed webhooks

HMAC-SHA256 verified with a 5-minute tolerance to prevent replay.

Encrypted in transit

Modern TLS everywhere. Secrets stay server-side, never in the browser.

Least privilege

Privileged keys run only inside verified server handlers.

Maintained by AirInk and current as of this deployment.

Platform evidence

Lovable Trust Center.

AirInk runs on Lovable, which publishes a Trust Center for this deployment. It is generated and maintained by Lovable, not by AirInk, and reports platform-level security evidence for airink.ai.

The evidence export is available to signed-in users. It bundles the published JSON evidence, retrieved server-side, with the AirInk control list above.

Shared responsibility

Who owns what.

AirInk owns the platform, its authentication, its Stripe integration, and the controls above. You own the accuracy of your contract terms, your milestone confirmations, and the security of your own devices.

Important disclosures
  • Platform, not a bank. AirInk is a technology platform. We do not hold customer funds. All payments are processed and held by Stripe Payments, a licensed money transmitter, in FBO (for-benefit-of) accounts pending release.
  • Introductory pricing. Rates shown are our launch pricing. The founding rate (a flat 0.49%) is locked for life on the account once invited in. The standard rate (0.99%) is the published launch rate and may adjust as we exit the launch window, we'll give at least 30 days' notice before any change. Bank transfer processing is included in the AirInk fee; card processing is itemized separately at the rates shown in your fee schedule.
  • How fees are charged. The AirInk platform fee is charged on each released payment: a flat 0.49% plus $2.49 per payment for founding vendors (0.99% plus $2.49 at the standard rate), with no subscription and no minimum of any kind. Bank transfer (ACH) processing (0.8% capped at $5.00) is paid by AirInk out of its own fee, so a bank payment carries the platform fee alone. Card, wire and BNPL processing are itemized separately at the rates shown in your fee schedule: card 2.9% + $0.30, wire $8.00 flat, BNPL 6% + $0.30. Fees exclude any applicable taxes. Processing is never folded into the AirInk fee as a blended rate.
  • Identity verification. Vendors must complete Stripe Identity KYC before their first payout. This helps prevent fraud and meets Stripe Connect requirements.
  • Not legal or financial advice. Contract templates and AI copilots are informational only. Consult a licensed attorney or accountant for legally binding matters.
  • Availability. AirInk is currently available to US-based vendors and clients. International support is coming soon.
  • Disputes. Payment disputes are handled through Stripe's dispute process. AirInk provides tools to submit evidence but does not adjudicate outcomes.
Security reporting

Found a vulnerability? Tell us.

Report suspected vulnerabilities to security@airink.ai. Include the affected URL or endpoint, steps to reproduce, and the impact you believe is possible. We acknowledge reports within 3 business days and keep you informed until the issue is resolved.

We support good-faith security research: do not access, modify, or delete data that is not yours, do not degrade the service for others, and give us a reasonable window to fix the issue before any public disclosure. Research conducted within those bounds will not be met with legal action by AirInk. A machine-readable version of this policy lives at /.well-known/security.txt.

Incidents

If something goes wrong.

AirInk maintains a written incident response plan covering triage, containment, remediation, and notification. If an incident affects your data, we will notify you by email without unreasonable delay, consistent with applicable state breach-notification laws, and tell you what happened, what data was involved, and what we are doing about it. Payment card and bank credentials are held by Stripe, not AirInk, which limits what any AirInk-side incident can expose.

Payments you can defend in writing.

Create your accountSee pricing

Introductory pricing: the rate rises once the founding cohort closes. Yours locks for life.