Security at AirInduct Sim
How we protect your account and your simulation data.
Infrastructure
- The site, the app and the API run on Railway with managed PostgreSQL, behind Cloudflare. The internal admin console is hosted separately on Vercel.
- All traffic served over TLS 1.2+ with HSTS enabled.
- Production data is encrypted at rest using AES-256.
Access control
- Role-based access control with least-privilege defaults.
- Production access requires SSO + 2FA for staff.
- Customer data segregated by Postgres Row-Level Security policies.
Application security
- API rate limits enforced per user and per IP.
- Dependencies audited weekly via automated scans.
- Sentry collects errors with PII scrubbing enabled.
Operations
- Daily encrypted database backups, 30-day retention.
- Quarterly access review.
- Incident response runbook with on-call rotation.
Reporting issues
- Email [email protected] with details and reproduction steps.
- We acknowledge reports within 2 business days.
- Coordinated disclosure preferred; no bug bounty program at this time.