Security & Compliance

1. Encryption

• All traffic is served exclusively via HTTPS/TLS with HSTS and automatic upgrade of insecure requests.
• Database data and files are stored encrypted on the cloud provider's infrastructure.
• Third-party service credentials are kept as secrets on the server and are never exposed to the browser.

2. Access control

• Access to administrative data only with a certified account and staff role.
• Roles are maintained in a separate table and verified on the server for each action.
• Row-level security (RLS) policies prevent all direct access from the client.

3. Application defense

• Application firewall with path-based rules for known attack patterns (SQLi, XSS, path traversal, probing).
• Rate limiting on public forms and critical paths, with secure 429 responses.
• Strict security headers: CSP, HSTS, nosniff, referrer policy, permissions policy.
• Validate all inputs with schemas on both client and server sides.

4. 24/7 monitoring and incidents

• Automatic HTTPS/TLS checks every 15 minutes for each active domain, including chain, issuer, and expiry date verification.
• Recording security incidents with severity, correlation ID, and identification/resolution workflow.
• Email notifications only for critical findings, with thresholds and prevention of repetitive alerts.
• Dependency checks and static code analysis on every deployment.

5. Logging and traceability

Every administrative action, status change, email dispatch, and GDPR request is logged with user, timestamp, and ID, ensuring a complete audit trail for compliance.

6. Retention and backups

Database backups are performed by the infrastructure provider. Log files are subject to a regulated retention policy and are automatically deleted after expiration.

7. Responsible vulnerability disclosure

If you identify a potential vulnerability, please send a report to info@veritron.co with the subject "Security". We request that it not be disclosed before it is remedied, and we commit to an initial response within 72 hours.

Please avoid tests that impact the availability or data of actual users.