Security Policy
Dieses Dokument ist noch nicht auf Deutsch verfügbar. Bis eine professionell geprüfte Übersetzung vorliegt, wird die englische Fassung angezeigt.
How we protect your data
- HTTPS everywhere with HSTS — all traffic is encrypted in transit.
- Passwords hashed with bcrypt (cost 12); never stored or logged in plain text.
- Application documents and verification evidence live in separate private local storage, reachable only through authorization-checked, short-lived signed links.
- Role-based access control re-checked server-side on every sensitive operation; admin actions are audit-logged.
- Multi-factor authentication for administrator accounts (rolling out before public launch).
- Rate limiting, secure cookies, CSRF protection, a strict Content-Security-Policy, and secret redaction in logs.
- Access-restricted local database and media backups with checksum verification and periodic isolated restore tests. These same-server backups are not full disaster recovery.
Responsible disclosure
Found a vulnerability? Email tech@drapartmentfinder.com with steps to reproduce. Give us a reasonable window to fix before public disclosure, don't access other people's data, and we won't pursue good-faith researchers — we'll thank you.