01 · Our Security Program
Our security program is designed around NIST Cybersecurity Framework principles — identify, protect, detect, respond, recover — layered with least-privilege access, secure-by-default configuration, and continuous monitoring. The program is reviewed annually and updated as our services and the threat landscape evolve.
02 · Data Encryption
All data is encrypted at rest using AES-256-GCM and in transit using TLS 1.3 (TLS 1.2 accepted only for legacy client compatibility; TLS 1.1/1.0/SSL disabled). HSTS with preload is enabled on our public domains. Internal service-to-service traffic uses mutual TLS where it crosses network boundaries.
03 · Authentication & Access Control
Multi-factor authentication is required for all employees and long-lived administrative accounts. Passwords are stored as argon2id hashes. API tokens are scoped to the minimum necessary permissions and rotated on role change or suspicion of compromise. Access is granted on a need-to-know basis and reviewed quarterly.
04 · Application Security
We follow OWASP Top 10 and ASVS guidance. Code is reviewed before merge, dependencies are scanned continuously for known vulnerabilities, and static analysis runs in CI. Security-relevant changes require two-person review. Critical fixes ship within 72 hours of disclosure; high-severity within 7 days.
05 · Infrastructure Security
Production runs on AWS Lightsail behind Cloudflare. WAF rules block common attack patterns (SQL injection, XSS, PHP exploitation, known botnets). Admin access is restricted by IP allow-list and SSH key authentication. All infrastructure changes are logged and reviewed.
06 · Incident Response
We maintain a documented incident-response plan with defined roles, communication templates, and post-incident-review procedures. Incidents are triaged by severity; critical incidents trigger immediate on-call response, containment, eradication, and recovery steps, followed by a written post-mortem.
07 · Vulnerability Disclosure
We welcome reports from security researchers. Submit findings via the Engage page (/engage) with the subject line "security" or through the chat on any page. We acknowledge receipt within 72 hours, triage within 7 days, and commit to acting in good faith — no legal action for research conducted in accordance with responsible disclosure principles.
08 · Subprocessors
We use a curated set of subprocessors for hosting, CDN and edge protection, analytics, email delivery, AI inference, and payment processing. Each is bound by a written data-protection agreement. A current list is available on request via /engage. We give reasonable notice of new subprocessors that process personal data.
09 · Employee Access & Training
Employees and contractors sign confidentiality agreements. Access to production data is limited to those whose role requires it, is logged, and is reviewed quarterly. All personnel complete security-awareness training on onboarding and annually thereafter, covering phishing, data handling, incident reporting, and applicable privacy law.
10 · Compliance
We align our controls to recognized frameworks (ISO 27001 control families and SOC 2 Trust Services Criteria) even where formal certification is not in place, and we continue to mature toward formal certification. We comply with applicable data-protection laws in the regions where we operate (see regional notice below for specifics).
11 · Backup & Disaster Recovery
Databases and critical data stores are backed up daily with encrypted snapshots retained for 30 days. Recovery procedures are tested periodically. Our target Recovery Point Objective (RPO) is 24 hours and Recovery Time Objective (RTO) is 4 hours for the primary service; these targets are reviewed as our services grow.
12 · Breach Notification (region-specific)
If we discover a security incident affecting personal information, we notify affected individuals and relevant authorities in accordance with the applicable law in your region. See the regional notice below for the specific notification window and competent authority that applies to you. US users: we notify affected individuals without unreasonable delay in accordance with the applicable state breach notification law. Typical windows range 30–60 days. California and New York residents receive additional statutory disclosures.
13 · Report a Vulnerability
To report a suspected vulnerability, use the Engage page (/engage) with subject "security" or the chat on any page. Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and remediate. We credit reporters on request after the fix ships.