Security
Security at Gavel
We treat security as a first-class feature. Here's how we protect your data.
Last updated: [REPLACE WITH DATE OF YOUR LAST SECURITY-PRACTICES REVIEW]
Compliance frameworks we align with
Encryption
In transit
All data between clients and our servers is encrypted using TLS 1.3. We enforce HSTS and reject older protocol versions.
At rest
Databases, file storage, and backups are encrypted with AES-256. Encryption keys are rotated quarterly and stored in a separate key management service.
Secrets management
API keys, credentials, and service tokens are stored in a dedicated secrets vault — never in environment variables or code repositories.
Infrastructure
Compliance posture
Our architecture is designed to support industry-standard compliance requirements. Our controls are designed to be independently verifiable — consult your compliance team for current certification status.
Network segmentation
Production systems are isolated in private VPCs. No direct public internet access to databases or internal services.
DDoS protection
All endpoints sit behind enterprise-grade DDoS mitigation with automatic traffic scrubbing and rate limiting.
Application security
Dependency scanning
All dependencies are automatically scanned for CVEs on every commit. Critical vulnerabilities trigger immediate patching with SLA < 24 hours.
Code review
Every change requires peer review. Security-sensitive paths (auth, billing, data export) require a second review from the security team.
Penetration testing
Our application is designed for regular third-party security assessment. Consult your security team to establish a penetration testing programme aligned with your risk profile.
Responsible disclosure
If you discover a security vulnerability, please report it to us privately at security@example.com. We request that you do not publicly disclose the vulnerability until we have had a reasonable opportunity to investigate and remediate it.
We will acknowledge your report within 24 hours , keep you informed of our progress, and credit you in our security advisories if you wish. We do not pursue legal action against researchers acting in good faith.