Skip to content

Security

Smailander's security measures and best practices.

Security Features

Encryption

  • At Rest: AES-256 encryption for all stored data
  • In Transit: TLS 1.3 for all API communications
  • Database: Transparent Data Encryption (TDE) enabled

Authentication

  • Magic Links: Passwordless authentication
  • API Keys: Secure key-based authentication
  • Multi-Factor: Optional 2FA support

Authorization

  • Role-Based Access: Granular permissions
  • API Key Scoping: Limit key permissions
  • Audit Logging: Complete access audit trail

Data Protection

  • Email Masking: Hide original email addresses
  • PII Protection: Encrypt sensitive information
  • Anonymization: Option to anonymize data

Security Best Practices

For API Keys

  1. Store in environment variables
  2. Never commit to version control
  3. Rotate every 90 days
  4. Use scoped permissions
  5. Monitor usage regularly

For Webhooks

  1. Use HTTPS endpoints
  2. Verify signatures
  3. Implement retry logic
  4. Monitor for abuse
  5. Rate limit endpoints

For Data Handling

  1. Minimize data collection
  2. Encrypt sensitive data
  3. Implement access controls
  4. Regularly audit permissions
  5. Follow GDPR guidelines

Compliance

  • GDPR: Fully compliant with EU GDPR
  • SOC 2: Type II compliant (planned)
  • HIPAA: Available for healthcare customers
  • ISO 27001: Certification in progress

Security Audits

Regular security audits are performed: - Penetration Testing: Quarterly - Code Reviews: Continuous - Dependency Scanning: Daily - Vulnerability Scanning: Weekly

Incident Response

Our incident response process: 1. Detection: Automated monitoring 2. Notification: Immediate alerts 3. Containment: Isolate affected systems 4. Investigation: Determine root cause 5. Remediation: Apply fixes 6. Post-Mortem: Document and improve

Reporting Security Issues

Found a security vulnerability? Report it responsibly:

Email: security@smailander.com

Include: - Description of the vulnerability - Steps to reproduce - Proof of concept (if applicable) - Contact information

We'll respond within 24 hours and provide updates.

Support