Security

Reporting a vulnerability

Email hello@thecompound.tech. Include the URL, what you did, and what you saw. There is no bounty and no NDA to sign. We will confirm receipt, and we will tell you what we changed.

The same address, with a machine-readable expiry, is published at /.well-known/security.txt under RFC 9116.

Accounts

BenchFile has no user accounts. There is nothing to sign in to, no password to reset and no session to steal, and a build gate fails the deploy if an authentication route ever appears in this repository while this page still says otherwise.

What is stored

• The address or BBL you type into the lookup is sent to NYC Open Data to run the query, and is not written down here — the lookup has no database behind it
• If you buy, Stripe collects your billing address, your card and your ConEd account number; the ConEd number is what lets us request the building's energy data authorisation
• Anonymous usage analytics — page views and clicks. Form inputs are masked in session recordings and no profile is created for a visitor who never identifies themselves

Who else processes data

• Stripe — takes the payment and holds the card details — we never see a card number
• PostHog — anonymous product analytics, proxied through this domain
• Vercel — serves this site and holds its access logs
• NYC Open Data — answers the building lookup — the address you type is sent to the city's public API to run the query

Also true

• The lookup reads the city's public datasets on every request and keeps nothing you type.
• The building pages under /buildings read one table this product owns. It holds public facts from those same NYC Open Data files, one row per building, and nothing a visitor types.
• Payment pages are Stripe's own hosted checkout on a Stripe domain, so a card number is never typed on this site.

BenchFile is built and run by Compound Labs. The declarations on this page are part of this product's own configuration and are re-checked at every deploy against the repository they describe: a product that claims to have no accounts and ships an authentication route fails the build, and so does one that takes payment without naming its payment processor here.