Security at ChainPeace

• In transit: TLS 1.2+ enforced on every endpoint; HSTS preload; modern cipher suites only; HTTP/3 where supported.
• At rest: AES-256 on database volumes, object storage and backups.
• Application layer: sensitive fields are additionally hashed or tokenised where feasible (e.g. passwords with bcrypt/argon2 by our identity provider; payment cards tokenised at Stripe).
• Roadmap: end-to-end encrypted messaging (X25519 sealed-box, Ed25519 signatures) is designed and being staged for release.

• Mandatory password strength check against known-breach corpora.
• Multi-factor authentication (TOTP) available to all users and required for privileged roles.
• Role-based access control (RBAC) enforced at the database with PostgreSQL Row-Level Security.
• Least-privilege service credentials; production access is restricted to a small named group and is audit-logged.
• Inactivity timeout and visible session management with user-initiated revoke.

• Secure SDLC: peer review on every change, automated linting, dependency scanning, secret scanning, and CI checks before deployment.
• Defence-in-depth against OWASP Top 10 (input validation, parameterised queries, CSRF protections, output encoding, strict CSP, anti-clickjacking headers, secure cookies).
• Server-side authorisation on every privileged operation; client controls are never trusted.
• Tenant isolation enforced at the row level by policies that reference auth.uid() and role lookups via a SECURITY DEFINER helper.

• Hosted on Lovable Cloud (Supabase) and Cloudflare, in UK/EU regions.
• Network and DDoS protection at the edge; automatic failover between regions for stateless tiers.
• Daily encrypted backups with point-in-time recovery; backup restoration is tested at least quarterly.
• Production isolated from development and staging; no production data is used in non-production environments without irreversible anonymisation.

• Append-only application audit log (sign-ins, MFA events, role changes, document access, admin actions).
• Database query logs and slow-query monitoring.
• Real-time alerting on anomalous authentication, privilege escalation and high-volume export events.
• Log retention: 13 months (security & audit), longer where required by law.

• Continuous dependency monitoring via automated SCA; high/critical vulnerabilities triaged within 48 hours and remediated within risk-based SLAs (critical: 7 days; high: 30 days).
• Periodic third-party penetration testing of the production application.
• Coordinated vulnerability disclosure (see §9).

• Background checks for staff with production access, subject to applicable law.
• Annual security awareness and data-protection training.
• Sub-processors are assessed before onboarding and re-reviewed annually; the current list is published in the Privacy Policy.

• Documented incident response plan with defined roles, severity levels and communication tree.
• Confirmed personal data breaches are notified to the ICO within 72 hours where required by UK GDPR Art. 33, and to affected individuals without undue delay where Art. 34 applies.
• Post-incident reviews are conducted and remediations tracked to closure.

If you believe you have found a security vulnerability, please report it to security@chainpeace.com. We commit to:

• acknowledge your report within 2 business days;
• investigate and keep you informed of progress;
• not pursue legal action against good-faith researchers who comply with this policy (no service disruption, no access to data beyond what is necessary to demonstrate the issue, no public disclosure before a fix is released).

PGP key fingerprint available on request. Please do not test on accounts you do not own.

• UK GDPR and Data Protection Act 2018 compliant; ICO-registered controller.
• PECR-compliant cookies and marketing.
• PCI-DSS: out of scope at the application layer — card data is handled by Stripe (PCI-DSS Level 1).
• Aligned with ISO/IEC 27001 controls; certification roadmap in progress.
• Annual penetration test and SOC 2-style controls maturity assessment.

• Enable MFA, use unique passwords, and protect your devices.
• Apply least-privilege when inviting team members; revoke access promptly when it is no longer needed.
• Do not upload special-category data (e.g. health, biometric) unless agreed in writing with us.
• Report suspected compromise to security@chainpeace.com as soon as possible.

Security: security@chainpeace.com
Privacy: privacy@chainpeace.com