Security Policy

How we protect your data

• HTTPS everywhere with HSTS — all traffic is encrypted in transit.
• Passwords hashed with bcrypt (cost 12); never stored or logged in plain text.
• Application documents and verification evidence live in separate private local storage, reachable only through authorization-checked, short-lived signed links.
• Role-based access control re-checked server-side on every sensitive operation; admin actions are audit-logged.
• Multi-factor authentication for administrator accounts (rolling out before public launch).
• Rate limiting, secure cookies, CSRF protection, a strict Content-Security-Policy, and secret redaction in logs.
• Access-restricted local database and media backups with checksum verification and periodic isolated restore tests. These same-server backups are not full disaster recovery.

Responsible disclosure

Found a vulnerability? Email tech@drapartmentfinder.com with steps to reproduce. Give us a reasonable window to fix before public disclosure, don't access other people's data, and we won't pursue good-faith researchers — we'll thank you.