Security
Infrastructure
The Service is hosted by our cloud hosting provider. Application data is stored in PostgreSQL and Redis.
Encryption
Traffic between you and the Service is encrypted in transit using TLS, and session cookies are marked secure and HTTP-only. Passwords are stored only as one-way hashes. Secrets are kept in environment configuration, not in source control.
Access control
Accounts require a verified email address, and you can turn on two-factor authentication in Settings. Sign-in, registration and password-reset requests are rate limited. Administrative access is role-based and limited to authorised personnel, and admin tooling is gated behind elevated roles. The app sends a Content-Security-Policy header, and server-side requests to outside websites go through a guarded client that refuses internal network addresses.
Monitoring
We use error- and performance-monitoring (Sentry) and queue/job observability (Horizon) to detect and respond to issues. Document-access events in the regulatory library are recorded in an activity log.
Sub-processors
We engage vetted sub-processors under data-protection terms - see our Privacy Policy and Data Processing Addendum.
Reporting a vulnerability
If you believe you have found a security issue, please email hello@pitchsafe.io with details. Please do not publicly disclose until we have had a reasonable opportunity to investigate and remediate. We appreciate responsible disclosure.