Security and data handling designed for sensitive contact data.
This page documents controls actually present in the application architecture and clearly separates them from infrastructure controls that still depend on the production deployment.
Application-level controls implemented in the repository
The current codebase includes concrete security controls that can be documented after production configuration is verified.
AES-256-GCM encryption for sensitive application blobs using the configured data-encryption key.
Server-side object storage with private access; S3 uploads request AES256 server-side encryption when S3 mode is used.
Opaque session tokens stored as hashes.
API key digests rather than raw API keys in the database.
Role-based application access and admin audit records.
HMAC-derived cache identifiers so raw phone/email values are not used as cache keys.
Signed customer webhooks and destination checks.
Data minimization and retention
Uploads, cached results, and customer policies have explicit retention controls. The application clamps cache TTL to a maximum of 90 days; production retention should be set to the minimum period the business workflow requires.
What still requires production infrastructure
Repository controls are not the same as a complete security certification.
Production WAF/rate-limit strategy.
Managed secret storage and rotation.
Database encryption/backups and restore testing.
Egress/network policies.
Central monitoring, alerting, and incident response.
Independent security review and any formal compliance certification.
Security claims policy
Do not show SOC 2, ISO 27001, GDPR “certified”, penetration-test badges, uptime SLAs, or similar trust marks until there is actual evidence supporting the exact claim.
Questions about security
Are phone numbers stored as plaintext cache keys?
No. The cache architecture derives HMAC identifiers from normalized input and stores encrypted result payloads.
Are API keys stored in plaintext?
The application uses digests for API-key lookup. Raw secret handling should be limited to key creation/display and the customer’s own secret store.
Does this page mean the company is SOC 2 certified?
No. Do not claim a certification until an independent, current report exists for the production organization and scope.
What should I do if I discover a security issue?
Use the production security reporting channel once it is configured and published; do not rely on an invented placeholder address.
Related verification solutions
Explore related verification capabilities, documentation, and pricing.
See the job composition before you commit.
Start with a free preflight scan. Review duplicate counts, syntax formatting, cache eligibility, and the frozen maximum quote in integer micros.