Security
Built to protect the calls and leads that keep local businesses moving.
Effective date: April 16, 2026
Mytha handles business-critical reception workflows for home service companies. Our security approach focuses on limiting exposure, protecting lead data, monitoring failures, and keeping production systems simple enough to operate reliably.
Data protection
Website lead data is stored in Postgres with least-privilege application credentials. IP addresses used for lead safety and analytics are hashed where practical before storage. Secrets are expected to live in environment variables or the production host secret manager, not in source code.
Application safeguards
The website uses request size limits, JSON-only API inputs, basic rate limiting, form validation, server-side error reporting, security headers, and Content Security Policy rules to reduce common abuse paths.
Infrastructure posture
The recommended home-server deployment keeps Postgres private inside Docker and exposes only the web app through Cloudflare Tunnel. Public database ports should stay closed. Backups should be encrypted or access-controlled and copied off the server.
Access and operations
Production access should be limited to trusted operators using strong passwords, multi-factor authentication where available, and SSH keys instead of shared passwords. Error and lead notification webhooks should be treated as secrets because they can receive operational data.
Reporting security concerns
To report a security concern, contact hello@mytha.ai. Please include the affected URL, steps to reproduce, and any relevant request IDs or timestamps. Do not include sensitive customer data unless we ask for it through a secure channel.
This security page is written for launch readiness and customer trust. It should be reviewed against the final production environment before broad public use.