Security

1. Transport & application security

• HTTPS/TLS for the website, dashboard and API gateway.
• Secure session cookies for authenticated dashboard access.
• Password storage using industry-standard hashing (never plaintext).
• Role-based access for customer, provider and admin surfaces.

2. API keys

• Keys are shown in full only at creation time when possible.
• Stored keys are hashed or otherwise protected at rest for verification.
• You can revoke keys immediately from the dashboard.
• Gateway requests require a valid key and respect plan quotas.

3. Logging & monitoring

We log request metadata (time, path, status, key id, latency) for billing, reliability and abuse detection. We avoid storing full request/response bodies unless needed for debugging a specific issue you asked us to investigate.

4. Infrastructure

Production services run on reputable cloud providers with network isolation, backups and restricted administrative access. Access to production systems is limited to authorized operators.

5. Your responsibilities

• Protect dashboard credentials and enable strong passwords.
• Never embed secret keys in public repositories or frontend bundles.
• Rotate keys after team members leave or if exposure is suspected.
• Follow the Acceptable Use and API Usage policies.

6. Reporting a vulnerability

If you believe you found a security issue, email [email protected] with steps to reproduce. Please give us reasonable time to investigate before public disclosure. Do not access other customers’ data or disrupt the service while testing.

7. Privacy

Personal data handling is described in our Privacy Policy.