Security

How we protect your awards program, your sponsors, and your voters.

Encryption

· TLS 1.2+ enforced (HSTS preload).
· AES-256 at rest for Postgres + S3-compatible object storage.
· AES-256-GCM application-layer encryption for OAuth tokens, TOTP secrets, etc.
· Argon2id for passwords (memoryCost 19 MiB).
· Open Badges 3.0 winner credentials signed with Ed25519.

Authentication

· Email + password, Google OAuth, Resend-delivered magic-link.
· TOTP 2FA (RFC 6238) with single-use recovery codes.
· Session JWTs, ±5 min clock skew tolerance.

Data isolation

· Every query traverses Organization → Show → Nomination ownership.
· Capability-based RBAC enforced server-side; UI hides controls but server is the source of truth.
· Per-org S3 storage key prefixes (org/{orgId}/...) for blast-radius isolation.

Application security

· Strict Content-Security-Policy with frame-ancestors 'none' (relaxed only for /embed/*).
· Stripe webhook signatures verified on every event.
· Outbound webhook deliveries signed with HMAC-SHA256.
· Rate limits on every public endpoint (Redis-backed).
· Honeypots + minimum-time-on-page checks on Ballotis polls.

Operations

· Daily encrypted Postgres snapshots (Railway-managed). RPO 24h target, RTO 4h target.
· Append-only audit log; admin-side viewer at /[org]/audit.
· Pino structured logs with PII redaction.
· Secrets via Railway env; never committed to git.
· Single region (US West).

Compliance

· No SOC 2 report yet.
· GDPR + UK GDPR + CCPA/CPRA — DPA at /dpa, sub-processor list at /subprocessors.
· Open Badges 3.0 / W3C Verifiable Credentials with Ed25519 signing for winner badges.
· EU-US Data Privacy Framework: not enrolled (US transfers via SCCs).

Vote integrity (Ballotis)

· Email magic-link verify, IP/email caps, ISO-country geofencing (when the Cloudflare country header is present), CAPTCHA.
· Rule-based fraud checks: velocity bursts, coordinated patterns, disposable-email, user-agent screening, repeat-offender.
· Optional audit chain (off by default): per-voter receipts, tamper-evident hash chain, public verification page (/verify/{pollId}).
· Append-only vote records with supersede semantics for change-vote (where allowed by preset).

Reporting a vulnerability

Found something? Email security@aclamos.app (PGP key on request) or use the in-app feedback widget with kind = "Security." We acknowledge reports within 2 business days and give a triage decision within 7 days. Coordinated disclosure timeline: 90 days standard, accelerated for critical issues.

No SOC 2 report yet. Need a signed DPA? Email trust@aclamos.app. Engineering details for technical reviewers: see /dpa and /privacy.