Security & Trust
StruckBox is a training-first SaaS platform for the fire service. We are not an RMS, ePCR, or system of record — but training records, member rosters, and SOG content still need to be handled carefully. This page lays out exactly what we do, what we use, and who you call when something looks wrong.
All traffic to and from struckbox.com is encrypted with TLS 1.2+ and HSTS preload. No mixed-content fallbacks.
All structured data is stored in our Neon PostgreSQL instance with AES-256 encryption at rest. Backups are encrypted.
Authentication is handled by Clerk. Passwords are never stored on our servers. SSO, MFA, and session controls are available on department plans.
Admin access to production data is limited to the founder, scoped via short-lived credentials, and logged.
We use the following infrastructure providers to deliver the platform. Each one has its own SOC 2 or equivalent posture and its own published security documentation. If a department's procurement requires a Data Processing Agreement (DPA), email us at support@struckbox.com and we will route the right DPA from the appropriate provider.
Clerk
Authentication & user management
Email, name, authentication tokens
Stripe
Payment processing
Billing email, payment method (Stripe-tokenized, never on our servers)
OpenAI
Voice transcription (Whisper) & AI features
Audio recordings (transient, not stored after transcription) and text prompts
Anthropic
AI scoring, evaluation, and content generation
Text prompts and training-related content
Neon
PostgreSQL database hosting (US region)
All structured platform data: account, training progress, scores, content
Vercel
Application hosting & edge CDN
Page requests, IP addresses, edge logs
FAL.ai
Scene image generation
Text prompts for image generation
Resend
Transactional email
Email address and message content (account, training, notifications)
If you believe you've found a security issue, please email security@struckbox.com with a description and proof of concept. We commit to acknowledging reports within 2 business days and to keeping you informed as we investigate. We do not currently run a paid bug bounty program, but we publicly credit reporters with their consent.
Please give us a reasonable window to remediate before public disclosure. Do not access data that is not yours, do not run destructive tests, and do not pivot from one finding to attack other systems.
Need a DPA, MSA, security questionnaire, or insurance certificate for your procurement file? Email support@struckbox.com with your department name and procurement contact. We respond within one business day.
Last reviewed: June 1, 2026.