How we protect your data
Encrypted in transit, everywhere
Every page is served over HTTPS and enforced with HSTS (1 year, including subdomains) — your browser refuses to connect any other way, on every visit.
Credentials never reach the browser
Third-party API calls are proxied server-side, so access tokens are never visible in a browser's network requests. Stored secrets are encrypted at rest, never displayed in plain text.
Automated, offsite backups
Backups run on a regular automated schedule to independent cloud storage, kept separate from the production server itself.
Abuse protection built in
Public-facing endpoints are rate-limited to block automated abuse and scraping, without adding friction for real users.
Logs are for debugging, not data
Personal information is stripped from internal logs and error reports before they're written — logs exist to fix problems, not to store customer data.
Admin attack surface locked down
Legacy WordPress attack surfaces — XML-RPC, the REST API's public user directory, in-dashboard file editing — are disabled or restricted at the server level.
Have a specific security question?
If you need more detail for a vendor review or procurement checklist, we're happy to walk through it directly.
Contact us