Security

Written to be read. Where a clause has a practical consequence, the consequence is stated rather than implied.

Where we are honestly at

SOC 2 Type II is in progress with a target of Q2 2027; we are not certified today and will not imply otherwise. ISO 27001 is not started. Annual third-party penetration testing is in place and the summary is available under NDA.

A young company claiming a mature certification posture is the first thing a security reviewer should distrust, so here is the real position.

Platform

TLS 1.3 only, HSTS with preload, modern cipher suites. AES-256 at rest for every store including backups.

Infrastructure is declarative and peer-reviewed; production access requires hardware-key MFA and is logged. Containers run non-root on read-only filesystems.

Keys

API keys are stored hashed, never displayed again after creation, and can be scoped per service, restricted by referrer or IP, and rotated with a 24-hour overlap.

A key leaked in a public repository can be revoked from the console immediately; we also scan public sources for our own key format and notify on a match.

Application

Content Security Policy without unsafe-eval, strict transport and frame-ancestors headers, dependency scanning on every build, and no third-party scripts on the marketing site — the reason this page loads no analytics.

Disclosure

Reports to [email protected] are acknowledged within 24 hours. We do not pursue legal action against researchers acting in good faith, and we credit reporters in the changelog unless asked not to.

These are commercial terms, not legal advice. They were drafted to be read by the people who have to live with them; have your own counsel read them before you rely on them.