Security Policy
Ce document n’est pas encore disponible en français. La version anglaise est affichée pendant la préparation d’une traduction révisée par un professionnel.
How we protect your data
- HTTPS everywhere with HSTS — all traffic is encrypted in transit.
- Passwords hashed with bcrypt (cost 12); never stored or logged in plain text.
- Application documents and verification evidence live in separate private local storage, reachable only through authorization-checked, short-lived signed links.
- Role-based access control re-checked server-side on every sensitive operation; admin actions are audit-logged.
- Multi-factor authentication for administrator accounts (rolling out before public launch).
- Rate limiting, secure cookies, CSRF protection, a strict Content-Security-Policy, and secret redaction in logs.
- Access-restricted local database and media backups with checksum verification and periodic isolated restore tests. These same-server backups are not full disaster recovery.
Responsible disclosure
Found a vulnerability? Email tech@drapartmentfinder.com with steps to reproduce. Give us a reasonable window to fix before public disclosure, don't access other people's data, and we won't pursue good-faith researchers — we'll thank you.