Security & Data Breach Policy

• Encryption in transit (HTTPS) and security headers (HSTS, CSP, XFO, etc.).
• Role-based access control and least privilege.
• Password hashing using bcrypt and session security.
• Rate limiting and bot protection.
• Regular updates and vulnerability remediation.

We follow a triage and response process for security incidents:

1. Detection and validation
2. Containment and eradication
3. Recovery and post-incident review

If a data breach is likely to result in a risk to individuals, we will notify affected users without undue delay and, where applicable, notify relevant authorities (e.g., within 72 hours under GDPR).