Security Policy

1. Data Encryption

• In transit: all data transmitted between your browser and Cloutbox is encrypted using TLS 1.2 or higher. We enforce HTTPS-only access and use HSTS headers.
• At rest: all data stored in our database (Supabase) is encrypted at rest using AES-256.
• OAuth tokens: social platform access and refresh tokens are stored encrypted at the database level. They are never exposed in logs, error reports, or client-side responses.
• Backups: database backups are encrypted with the same encryption applied to primary storage.

2. Access Controls

• Principle of least privilege: employees and systems are granted only the minimum access required for their role. Access is reviewed quarterly.
• Production access: direct production database access is restricted to a small number of engineers, requires multi-factor authentication (MFA), and all access is logged with timestamps and queries.
• Supabase Row Level Security: all database tables use Row Level Security (RLS) policies to enforce organisation-level data isolation at the database layer — not just at the application layer.
• Service role key: the Supabase service role key is never exposed client-side. It is used only in server-side code and is not accessible to end users.
• Customer accounts: users authenticate via Supabase Auth (email/password or OAuth). Passwords are bcrypt-hashed with a minimum cost factor of 10. MFA is available to all users and enforced for admin roles.

3. Infrastructure Security

• Hosting: application infrastructure runs on Vercel (serverless, auto-scaling) and Supabase. Both providers maintain SOC 2 Type II certifications.
• Network: application is deployed on Vercel's global edge network. All serverless functions execute in isolated, ephemeral environments. There is no shared persistent compute environment.
• Dependency management: we use automated dependency scanning (Dependabot / Snyk) and apply security patches within 14 days of disclosure for critical/high CVEs, and within 30 days for medium/low.
• Secrets management: production secrets are stored as encrypted environment variables in Vercel. They are never committed to version control.
• CI/CD: all code changes go through pull request review. The production deployment pipeline includes automated type checking and linting before deployment.

4. Application Security

• CSRF protection: all state-modifying API routes require authentication. Next.js server actions use built-in CSRF protections.
• Input validation: user input is validated and sanitised on the server before database operations. SQL injection is prevented by use of parameterised queries via Supabase's PostgREST client.
• Content Security Policy: CSP headers are configured to restrict script sources and prevent XSS injection.
• Rate limiting: API routes are rate-limited per IP and per authenticated user. Platform API calls are rate-limited per the platform's terms to prevent abuse.
• HMAC verification: webhooks from Meta and other platforms are verified using HMAC-SHA256 signatures before processing. Signature comparison uses constant-time comparison to prevent timing attacks.
• OWASP Top 10: we maintain an internal checklist mapped to the OWASP Top 10 Web Application Security Risks and review it quarterly.

5. Monitoring and Incident Response

• Real-time monitoring: application errors and performance metrics are monitored 24/7 via Sentry. Infrastructure metrics are monitored via Vercel and Supabase dashboards.
• Security logging: authentication events (login, logout, failed attempts, MFA changes, password resets) and privileged actions are logged and retained for 12 months.
• Incident response: we maintain an incident response plan covering detection, containment, eradication, recovery, and post-incident review. The plan is reviewed annually and after any significant incident.
• Breach notification: in the event of a data breach, we will notify affected users and, where required, supervisory authorities within the timeframes required by applicable law (72 hours for GDPR; without unreasonable delay for US state laws). See our Privacy Policy Section 15 for details.
• Status page: service status and incident history are published at https://status.cloutbox.ai.

6. Penetration Testing and Audits

• Annual pen test: we commission an independent third-party penetration test at least once per year. Findings are remediated within the timeframes defined by our vulnerability management policy.
• Remediation SLAs: Critical: 24 hours; High: 7 days; Medium: 30 days; Low: 90 days.
• Security audit reports: summary findings (redacted) are available to Enterprise customers under NDA upon request.

7. Responsible Disclosure Programme

We welcome responsible disclosure of security vulnerabilities found in the Cloutbox platform. We commit to working collaboratively with researchers who follow this programme.

How to report

Email security@cloutbox.ai with subject "Security Vulnerability Report". Your report should include:

• A clear description of the vulnerability and its potential impact.
• Step-by-step reproduction instructions.
• Any relevant URLs, screenshots, or proof-of-concept code.
• Your name/handle (optional) for acknowledgement.

Our commitments to researchers

• We will acknowledge receipt of your report within 24 hours.
• We will provide a status update within 5 business days with our initial assessment.
• We will not pursue legal action against researchers who act in good faith in accordance with this programme.
• We will notify you when the vulnerability has been remediated.
• We will acknowledge your contribution publicly (with your permission) in our security hall of fame.

Scope — in scope

• cloutbox.ai and all subdomains.
• Cloutbox API endpoints.
• Authentication and session management vulnerabilities.
• Data exposure (PII leakage, broken access controls, IDOR).
• Server-side injection (SQLi, SSRF, RCE).
• Cross-site scripting (XSS) with demonstrated impact.

Scope — out of scope

• Denial of service attacks or load testing.
• Social engineering attacks against employees or users.
• Physical access attacks.
• Vulnerabilities in third-party services (Meta, X, Supabase, Vercel) — report those to the relevant vendor.
• Theoretical vulnerabilities without a working proof of concept.
• Automated scanner reports with no manual validation.

Bug Bounty

We operate a discretionary bug bounty programme. Rewards are at our sole discretion and depend on severity, impact, and quality of the report. As a guideline:

• Critical (RCE, full DB exfiltration): up to $1,000 account credit or cash (at our discretion).
• High (auth bypass, significant PII exposure): up to $500 credit.
• Medium (CSRF, limited data exposure): up to $150 credit.
• Low (informational, minor): acknowledgement and hall of fame listing.

We do not pay for out-of-scope findings, previously known issues, or reports from automated scanners without manual validation. Rewards are subject to applicable laws — we do not pay to persons in sanctioned countries or listed on OFAC/BIS restricted-party lists.

8. Employee Security

• All employees and contractors with access to customer data sign confidentiality agreements as a condition of engagement.
• Security awareness training is provided at onboarding and annually thereafter.
• Offboarding procedures include immediate revocation of all system access.
• Background checks are conducted for roles with production access, subject to local law.

Security Contact