Security Overview

We use industry-standard security practices appropriate to the Services we provide. This page is a customer-facing overview, not a penetration-test report or certification claim.

We do not claim SOC 2, ISO 27001, PCI DSS, or similar certifications on this page unless separately verified and published by us.

These documents are provided as a professional starting point for a technology/SaaS platform. They are not legal advice. Replace all placeholders, confirm the governing jurisdiction, and have a qualified legal professional review them before treating them as binding.

Accounts use hashed passwords and session cookies with modern browser security headers. Optional two-factor authentication may be available. Customers should protect credentials and rotate API keys if exposed.

Sign-in may use email/password and, when configured, third-party OAuth (for example Google via our Cloudflare OAuth Worker). We recommend unique passwords and enabling available MFA options.

Data in transit is protected with TLS. Sensitive secrets are stored using environment isolation and access controls. Payment card data is handled by payment processors where card checkout is used.

Production workloads run on controlled hosts with least-privilege access for operators. We avoid publishing detailed network diagrams or internal tooling that would aid attackers.

We monitor service health and retain operational logs for reliability and security. Backup practices are designed to support recovery from routine failure scenarios; recovery objectives may vary by product.

We investigate security incidents affecting the confidentiality, integrity, or availability of the Services and will notify affected customers when required by law or when we believe notification is necessary.

If you believe you found a vulnerability, email [email protected] with steps to reproduce. Please allow reasonable time for remediation before public disclosure. Do not access customer data or disrupt production services while testing.