Security

Data Encryption

We employ industry-leading encryption technologies to protect your data at every stage:

Authentication & Access Control

We implement multiple layers of authentication and access control to protect your account:

Password Security

• Minimum 12 characters with complexity requirements (uppercase, lowercase, numbers, special characters)
• Breach detection - passwords checked against known compromised credential databases
• Secure password hashing using bcrypt with adaptive cost factors
• Password history - prevents reuse of recent passwords

Session Security

• Secure session cookies with HTTPOnly and SameSite=Strict flags
• Session timeout after 2 hours of inactivity
• Session regeneration on login to prevent fixation attacks
• Concurrent session limits with ability to view and revoke active sessions

Brute-Force Protection

• Rate limiting - 5 login attempts per 5-minute window
• Progressive delays on failed authentication attempts
• Account lockout after repeated failed attempts
• IP-based monitoring for suspicious activity patterns

Application Security

Our application is built with security-first principles and protected against common web vulnerabilities:

Security Headers

Attack Prevention

• CSRF Protection: All forms and actions protected with cryptographically secure tokens
• SQL Injection Prevention: Parameterized queries using PDO throughout the application
• XSS Prevention: Strict output encoding and Content Security Policy enforcement
• Input Validation: All user inputs validated and sanitized server-side
• File Upload Security: Strict file type validation and isolated storage

Infrastructure Security

Our infrastructure is designed with defense in depth, providing multiple layers of protection:

Network Security

• Web Application Firewall (WAF) filtering malicious traffic
• DDoS Protection with automatic mitigation
• Network segmentation isolating different system components
• Regular vulnerability scanning and penetration testing

Server Security

• Hardened server configurations following CIS benchmarks
• Regular security patches and updates
• Minimal attack surface with only essential services running
• Intrusion detection and monitoring systems

Database Security

• Encrypted database connections using TLS
• Access controls limiting database privileges
• Regular backups with encryption
• Audit logging of database access and modifications

Compliance & Data Protection

Our security practices are designed to meet or exceed regulatory requirements across multiple jurisdictions:

Data Protection Measures

• Data minimization: We collect only necessary data for service provision
• Purpose limitation: Data used only for specified, legitimate purposes
• Storage limitation: Data retained only as long as necessary
• Privacy by design: Security built into every feature from the start
• Data subject rights: Full support for access, rectification, erasure, and portability requests

Incident Response

We maintain comprehensive incident response procedures to quickly address any security issues:

Response Process

1. Detection & Analysis: Automated monitoring and manual review identify potential incidents
2. Containment: Immediate steps to limit impact and preserve evidence
3. Eradication: Remove the threat and address root causes
4. Recovery: Restore normal operations with enhanced safeguards
5. Post-Incident Review: Document lessons learned and improve defenses

Breach Notification

In the event of a data breach affecting your personal information:

• Regulatory notification: Relevant authorities notified within 72 hours as required by GDPR/UK GDPR
• User notification: Affected users informed without undue delay if high risk to rights and freedoms
• Transparency: Clear communication about what happened, what data was affected, and remediation steps

Security Best Practices for Users

Help us keep your account secure by following these recommendations:

Responsible Disclosure

We value the security research community and welcome responsible disclosure of vulnerabilities:

Reporting Security Issues

If you discover a security vulnerability, please report it responsibly:

• Email us at security@confidion.com
• Include detailed information about the vulnerability
• Provide steps to reproduce the issue
• Allow us reasonable time to address the issue before public disclosure

Our Commitment

• We will acknowledge receipt of your report within 48 hours
• We will provide regular updates on our progress
• We will not take legal action against researchers acting in good faith
• We will credit researchers (if desired) when issues are resolved