Security Policy

1. Our security commitment

We take security seriously, follow industry best practices, and continuously improve. This page is a public summary; full technical detail is provided to Enterprise customers under NDA.

2. Encryption

• In transit: TLS 1.2+ enforced via HSTS. HTTP redirects to HTTPS. Strict-Transport-Security header set in our Next.js configuration.
• At rest: database storage encrypted via Hetzner volume encryption. Backups encrypted.
• Passwords: bcrypt with cost factor ≥10. We never see plaintext passwords.
• Secrets: environment variables, never committed to the repository.

3. Authentication and access

• NextAuth.js (JWT strategy) with Google OAuth and email/password.
• JWT sessions with token-version revocation: chargeback or admin action invalidates all live sessions immediately.
• Email verification required for password-based accounts.
• Rate limiting on authentication endpoints to mitigate brute-force attacks.

4. Network and infrastructure

• Hosted on Hetzner Cloud, EU region (Germany).
• Application and database communicate over a private network.
• SSH access: key-only, no password authentication.
• HTTP security headers: X-Content-Type-Options nosniff, X-Frame-Options DENY, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy, HSTS.
• Rate limiting on public endpoints and authentication routes.

5. Application security

• Parameterized SQL via the pg library — no string concatenation.
• CSRF protection on state-changing requests via NextAuth and SameSite cookies.
• Idempotent webhook processing for Stripe (signature verification + per-event deduplication).
• Input validation at API boundaries.
• Output encoding via React (XSS-safe by default). No dangerouslySetInnerHTML on user input.

6. Data lifecycle protections

• Soft-delete with 30-day grace period for accounts.
• Automated hard-purge cron with IP anonymization (MD5).
• Security logs retained 180 days, then automatically purged.
• Backups encrypted, 30-day rotation, restore tested quarterly.
• GDPR data export available via account settings.

7. Subprocessor security

All subprocessors are GDPR-aligned. See Subprocessors and DPA for the full list and security commitments.

8. Monitoring and response

Internal monitoring of authentication events, error rates, and webhook health, with anomaly alerts to the operator. Our internal target for breach triage is 24 hours; notification to Enterprise customers under our DPA is within 72 hours of becoming aware of a Personal Data Breach.

9. Vulnerability disclosure (responsible disclosure)

We welcome reports from security researchers.

• Email: [email protected]
• PGP key: available on request.
• Scope: production hostnames at *.atlas-studio.eu.
• Out of scope: physical attacks, social engineering of staff or customers, denial of service, automated scanning without prior authorization, vulnerabilities in subprocessors (please report to the subprocessor).
• Safe harbor: we will not pursue legal action against good-faith researchers who follow this policy, give us reasonable time to remediate (90 days standard), and do not exfiltrate user data.
• Recognition: hall-of-fame credit available on request. No monetary bug bounty at present.

10. What is not covered

• SOC 2 / ISO 27001 certification (planned, not yet held).
• 24/7 on-call response SLA outside Enterprise contracts.
• DDoS protection beyond Hetzner-default mitigation.
• Third-party penetration testing (planned annually).

11. Incident communication

In a confirmed Personal Data Breach affecting users, we will:

1. Notify affected users by email within 72 hours.
2. Notify the Kosovo regulator (AIP) within 72 hours per Law 06/L-082.
3. Post a public notice on this page if widespread.

12. Contact

Email: [email protected], [email protected]

Address: Rrahim Beqiri 1, 10000 Prishtinë, Republic of Kosovo

NUI: 812382414

Phone: +383 45 957 990