Security

Last updated: February 7, 2022

Product Security

Development Process

We follow industry best practices, so security is built into our product and into our regular development process, which includes code reviews, unit tests, and integration tests.

All engineers are required to know the OWASP vulnerabilities and to use libraries, frameworks, and mitigations vetted and recommended by the security community.

Vulnerability Scanning

We regularly update our servers, tools, and libraries, and patch vulnerabilities as they are discovered. Our application, host, and network are automatically scanned. We also automatically detect out-of-date dependencies.

Infrastructure Security

Encryption

All data in transit runs over SSL. All passwords are hashed with bcrypt, and billing information is handled entirely by our PCI-compliant payment providers (Stripe and PayPal).

Secrets Management

Secrets are stored securely and never in source code. Access to our infrastructure and related services requires SSH and, where possible, two-factor authentication.

Monitoring and Logging

We are committed to keeping Preceden highly available. Our infrastructure runs on fault-tolerant systems, and backups are made daily. Redundant third-party providers give us 24/7 monitoring and alerting for any downtime.

Trust and Verification

Compliance

Preceden is hosted on DigitalOcean, a cloud infrastructure provider serving customers worldwide. Preceden is deployed to DigitalOcean's New York region (NYC1). For information about data residency, see DigitalOcean's data center locations.

DigitalOcean operates SOC 2 Type II audited data centers and complies with major industry standards including:

• ISO/IEC 27001
• SOC 1 and SOC 2 / SSAE 18
• PCI DSS
• GDPR
• CCPA

Security Research

We welcome responsible security research and disclosure involving our product and infrastructure. Report potential vulnerabilities to [email protected]. Valid findings will be considered for compensation.