TRUST CENTER

Controls you can verify.

This page documents current application controls without claiming certifications the service does not hold.

Data boundaries

Public website routes do not expose customer APIs. The application uses host-scoped secure cookies, owner-filtered queries, private file storage, and authenticated downloads.

Service boundaries

The central application does not perform external SMTP verification in production. A separate node authenticates with a hashed secret, claims leased work, and submits idempotent results over HTTPS.

Application security

Django password validation, login and public-form throttles, CSRF protection, HTTPS redirects, HSTS, clickjacking protection, content-type protection, CSP, and permissions policy are enabled in production.

Operational controls

MariaDB, Redis, workers, scheduler, and web processes are supervised within the supported hosting model. Private backups and retention tasks use restricted runtime paths.

See the security overview, disclosure process, and current component status.