Security Policy

This page describes the operational controls we run today and the process for responsible disclosure.

Controls in production

• All traffic is served over TLS 1.2+.
• Data at rest is encrypted by our managed database provider.
• Auth uses signed JWTs; sessions can be revoked instantly by the user or an admin.
• Row-level security is enabled on every user-owned table; server functions run under the caller's identity.
• Admin actions require an OTP challenge and are recorded in an append-only audit log.
• Verification badges are server-issued only — they cannot be set from the client.
• Uploaded attachments are stored in private buckets and served via short-lived signed URLs.
• Outbound email is signed (DKIM) via the platform sender domain.

Responsible disclosure

If you have discovered a vulnerability, please email security@zmail.foo with:

• A clear description of the issue and its impact.
• Steps to reproduce (screenshots, PoC scripts).
• Your name for credit (if you wish).

We commit to acknowledge within 3 business days and to keep you informed as we investigate. Please do not publicly disclose the issue until we have released a fix.

Out of scope

• Denial-of-service, spam, or physical attacks.
• Social engineering of our staff or users.
• Vulnerabilities in third-party services we depend on (report directly to them).

This page describes controls we operate. It is not an independent certification.