Trust Center
Transparency about how we protect your data and our infrastructure.
Security Posture
- ✓Detection engine isolated in its own container with one controlled network exit
- ✓Cloudflare proxy and DDoS protection on all domains
- ✓TLS 1.3 on all endpoints (Let's Encrypt, auto-renewed)
- ✓HashiCorp Vault for secrets management
CI/CD Security
- ✓Gitleaks secret scanning (blocks pipeline)
- ✓Trivy vulnerability scanning on every code push (findings reported for review)
- ✓Semgrep SAST (OWASP Top 10 + TypeScript rules)
- ✓CycloneDX software bill of materials on every code push
Compliance
- ✓OWASP Top 10 addressed (SAST + validation + CSP)
Data Protection
- ✓Account data returned only to the account that owns it, checked on every request
- ✓Self-hosted sign-in with one-time email links and codes (SuperTokens)
- ✓No third-party telemetry or analytics
Incident Response
Security incidents are logged and handled under our disclosure policy.
For security inquiries, contact [email protected]