Security

We take the security of your data seriously. This page summarizes our current security posture across authentication, infrastructure, data protection, and operational controls.

Authentication & Access Control

• Sign-in and session management are provided by our identity provider with modern protections.
• Role-based access control in the app and APIs prevents unauthorized access to admin features.
• Account suspension is enforced across API routes when applicable.

Infrastructure & Network

• Hosted on modern cloud infrastructure with managed, patched runtimes.
• Transport security enforced via HTTPS with HSTS and strict security headers.
• Service worker scope limited and APIs excluded from caching to protect dynamic data.

Data Protection

• Product analytics (if enabled) respects user consent and avoids full IP storage.
• Consent logs store truncated/hashed network identifiers for audit purposes.
• Sensitive payment data is tokenized by our payment processor; we do not store card PANs.

See also: GDPR and Privacy Policy.

Secure Development

• Security headers (CSP, XFO, XCTO, HSTS, Referrer-Policy, Permissions-Policy) are applied at the edge.
• Production builds strip debug logs from client and server codepaths.
• Secrets are managed via environment variables; API keys are never hardcoded.

Incident Response

We monitor logs and errors and follow a pragmatic incident response. Critical issues are triaged, mitigated, and root-caused with remediation actions. If user data is impacted, we notify affected users consistent with applicable laws.