Security

Security practices

• Defense-in-depth across app, network, and data layers
• Least-privilege IAM with periodic access reviews
• Mandatory MFA for admins and engineering roles
• Code reviews, SAST/DAST, and supply-chain scanning
• HSTS, secure cookies, CSP, and modern TLS

Data protection

• Encryption in transit (TLS 1.2+) and at rest (AES-256 or cloud-native KMS)
• Segregated environments (dev/stage/prod) with separate credentials
• Tokenization/pseudonymization for sensitive fields where practical
• Strict logging with redaction; access logs retained per policy

Incident response

1. Detect & Triage — intake, severity, scope
2. Contain & Eradicate — isolate systems, revoke keys, patch
3. Recover — validate integrity, restore services, monitor
4. Post-mortem — root cause, corrective actions, timelines
5. Notify — stakeholders and users when required by law or policy

Compliance & policies

• Privacy: see Privacy Policy
• Data retention & deletion per product policy; backups per schedule
• Vendor security review for critical third parties
• Annual security training and phishing simulations