Security
Overview

Encryption at Rest: All stored data is encrypted using AES-256 encryption with regularly rotated keys managed through a secure key management system.

Encryption in Transit: All communications use TLS 1.3 with perfect forward secrecy, ensuring that even if keys are compromised, past communications remain secure.

Data Minimization: We collect and store only the minimum data necessary to provide our services. Most interactions require no personal data at all.

Automatic Deletion: Project data is automatically deleted after 30 days unless you specifically request longer retention.

Secure Hosting: Our infrastructure is hosted on SOC 2 Type II compliant cloud providers with enterprise-grade physical and network security.

Network Security: All systems are protected by firewalls, intrusion detection systems, and DDoS protection. Network traffic is continuously monitored.

Regular Updates: All systems are kept up-to-date with the latest security patches and undergo regular vulnerability assessments.

Backup Security: Encrypted backups are stored in geographically distributed locations with strict access controls.

Principle of Least Privilege: All team members have access only to the systems and data necessary for their role.

Multi-Factor Authentication: All administrative access requires multi-factor authentication with hardware security keys.

Audit Logging: All system access and administrative actions are logged and monitored. Logs are tamper-proof and retained for compliance purposes.

Regular Reviews: Access permissions are reviewed quarterly and immediately upon role changes or termination.

24/7 Monitoring: Our systems are monitored around the clock for security incidents and anomalies.

Incident Response Plan: We have a documented incident response plan that includes immediate containment, investigation, and notification procedures.

Breach Notification: In the unlikely event of a security incident affecting your data, we'll notify you within 24 hours and provide regular updates.

Forensic Capabilities: We maintain forensic capabilities to investigate incidents and work with law enforcement when necessary.

To help protect your own security when using our services:

• Use our secure contact forms rather than email when possible
• Avoid including sensitive credentials or API keys in code submissions
• Use environment variables for sensitive configuration
• Consider using temporary or development credentials for testing
• Review our recommendations before implementing solutions in production