Security Practices

Encryption Active

• In transit: All connections to InfluencerArmor are encrypted using TLS 1.2+ (HTTPS). We enforce HTTPS on all endpoints — no exceptions.
• Passwords: User passwords are hashed using bcrypt with a cost factor that makes brute-force attacks computationally infeasible. We never store, log, or transmit plaintext passwords.
• Payment data: All payment processing is handled by Stripe. Credit card numbers never touch our servers.

Authentication Active

• Token-based sessions: We use cryptographically random 128-character tokens for session management. No predictable session IDs.
• Automatic expiry: Sessions expire after 30 days of inactivity. Tokens are invalidated server-side on logout.
• CSRF protection: All state-changing API requests are protected against cross-site request forgery attacks using double-submit cookie validation.
• Rate limiting: Authentication endpoints are rate-limited to prevent brute-force and credential-stuffing attacks.

Data Isolation Active

• Per-user access controls: Every database query is scoped to the authenticated user. Users cannot access another user's contracts, alerts, or monitoring data.
• Uploaded files: Contracts and documents are stored with randomized filenames and are accessible only through authenticated API requests.
• Session isolation: Each session is tied to a specific user ID. Token reuse across accounts is impossible by design.

Infrastructure Active

• Secured hosting: Our servers run on hardened shared hosting with cPanel-managed security, firewall rules, and automated patching.
• Regular backups: Database and file backups are performed regularly to prevent data loss.
• Error handling: Production errors are logged server-side only. No stack traces, database queries, or internal paths are ever exposed to clients.
• Input validation: All user input is validated and sanitized before processing. SQL injection, XSS, and other injection attacks are mitigated through parameterized queries and output encoding.

Monitoring Practices Active

• Public data only: Our impersonator detection and reputation monitoring systems scan only publicly available information on social media platforms. We never attempt to access private accounts, DMs, or protected content.
• Contract analysis: Uploaded contracts are processed by AI for analysis and are not shared with third parties or used for training purposes beyond service improvement.

Third-Party Audits Planned

We are planning to engage independent security firms for penetration testing and vulnerability assessments. As we scale, third-party audits will become a regular part of our security program.

SOC 2 Compliance Roadmap

SOC 2 Type II compliance is on our roadmap. We are building our processes and controls with SOC 2 requirements in mind, including access controls, change management, risk assessment, and incident response procedures.