This page documents controls actually present in the application architecture and clearly separates them from infrastructure controls that still depend on the production deployment.
The current codebase includes concrete security controls that can be documented after production configuration is verified.
AES-256-GCM encryption for sensitive application blobs using the configured data-encryption key.
Server-side object storage with private access; S3 uploads request AES256 server-side encryption when S3 mode is used.
Opaque session tokens stored as hashes.
API key digests rather than raw API keys in the database.
Role-based application access and admin audit records.
HMAC-derived cache identifiers so raw phone/email values are not used as cache keys.
Signed customer webhooks and destination checks.
Uploads, cached results, and customer policies have explicit retention controls. The application clamps cache TTL to a maximum of 90 days; production retention should be set to the minimum period the business workflow requires.
Repository controls are not the same as a complete security certification.
Production WAF/rate-limit strategy.
Managed secret storage and rotation.
Database encryption/backups and restore testing.
Egress/network policies.
Central monitoring, alerting, and incident response.
Independent security review and any formal compliance certification.
Do not show SOC 2, ISO 27001, GDPR “certified”, penetration-test badges, uptime SLAs, or similar trust marks until there is actual evidence supporting the exact claim.
No. The cache architecture derives HMAC identifiers from normalized input and stores encrypted result payloads.
The application uses digests for API-key lookup. Raw secret handling should be limited to key creation/display and the customer’s own secret store.
No. Do not claim a certification until an independent, current report exists for the production organization and scope.
Use the production security reporting channel once it is configured and published; do not rely on an invented placeholder address.
Use descriptive internal links so users and search engines can understand how these topics connect.
Start with a preflight, review duplicates, cache eligibility, fresh checks, and the frozen maximum quote.