Security & Infrastructure Safeguards
Security architecture, network controls, and data protection practices.
DNS-Layer SSRF Protection
All outbound worker requests perform DNS pre-flight verification against RFC 1918 private subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), link-local (169.254.0.0/16), and cloud metadata endpoints. Connections to internal networks are terminated before TCP handshake.
Strict Content Security Policy
Strict CSP headers enforced at Nginx edge: inline scripts and unauthorized third-party trackers are blocked by default. Static assets are externalized with Subresource Integrity (SRI) hashes during build pipelines.
Argon2id Password Hashing
User credentials are protected using salted Argon2id password hashing with memory and computational cost parameters. Plaintext credentials are never written to logs or storage.
API Key & Webhook Signatures
API keys are stored as one-way SHA-256 hashes and displayed only once at creation. Inbound Stripe webhooks are verified via HMAC-SHA256 signature verification.
Encryption in Transit & at Rest
All client communication requires TLS 1.3 with HSTS enabled. Production databases and backups utilize AES-256 volume encryption.
Responsible Disclosure Program
We maintain a public security declaration at /.well-known/security.txt. Report vulnerabilities to [email protected]. We acknowledge all reports within 48 hours.
For data processing agreements (DPAs), compliance certifications, or enterprise security questionnaires, contact our security team at [email protected].