Are cookies httpOnly and secure?
Yes. Cookies are httpOnly (not readable by JS), SameSite=lax, and secure in production.
What security headers are enforced?
CSP, HSTS, X‑Frame‑Options (frameguard), Referrer‑Policy, X‑Content‑Type‑Options (nosniff). Only trusted providers/CDNs are allowed in CSP.
Where is data stored?
In region‑specific data centers (configurable per tenant/plan). Storage location appears in your admin settings and DPA.
Do you encrypt at rest?
Yes. Data at rest uses strong encryption (e.g., AES‑256 or equivalent). TLS (HTTPS) is required in transit.
Do you support data deletion?
Yes. GDPR/CCPA‑compliant deletion/erasure upon request. We retain business records (e.g., invoices) as required by law.
How do I report a vulnerability?
Email security@your‑domain.com or visit /security.txt. We run a coordinated disclosure program and triage within an SLA.
Do you do pen‑tests or hold certifications?
Regular 3rd‑party pen‑tests are run. Formal certifications (e.g., SOC 2, ISO 27001) may be available depending on plan; ask support for current reports and NDAs.
How are secrets managed and rotated?
App secrets live in a secure secrets manager; rotation is enforced periodically. Webhook/API secrets should be rotated by customers at least every 90 days.
How do you handle PII?
Data minimization, purpose limitation, and role‑based access. Sensitive fields are redacted in logs and protected in backups.
Do you back up data? What’s the restore policy?
Yes. Regular backups with tested restores. See your plan for RPO/RTO targets. You can request export bundles for independent backups.