Security at Entrepreneurship of America

Your business ideas are among your most valuable assets. Here is a plain-English overview of how we protect your account, your data, and your payments across the platform.

Security Practices

• Managed authentication — Sign-in, passwords, email verification, and session management are handled by Clerk, a dedicated identity provider. We never store raw passwords, and every protected action is bound to your verified account.
• Two-factor for staff & leadership — Employee and CEO portals require a second factor (authenticator app or one-time email code) on top of the password — an app-level elevated session that guards internal tools against account takeover.
• Encryption in transit & at rest — All traffic is served over TLS. Sensitive security material such as two-factor secrets is encrypted with AES-256-GCM before it ever touches the database.
• PCI-compliant payments — Card payments run entirely through Stripe. Your card number never reaches our servers — we only store the minimal customer and subscription references needed to manage your plan.
• Role-based access & audit logging — Staff access is granted page-by-page by role, enforced on the server. Every internal action is written to a tamper-evident audit log the CEO can review at any time.
• Idea protection integrity — When you protect an idea we assign a unique EoA protection ID and a timestamp, and record a content fingerprint so the protected record can be independently verified later.

Report a Vulnerability

Found a security issue? We appreciate responsible disclosure. Email security@entrepreneurshipofamerica.com and we will investigate promptly. Do not post vulnerabilities publicly.