Infrastructure
- Hosted on Vercel (web), Render/Fly (API), and Supabase (database) — all SOC 2 / ISO 27001 attested platforms.
- All traffic served over TLS 1.2+ with HSTS enabled.
- Production data is encrypted at rest using AES-256.
LEGAL · SECURITY
Security at AirInduct Sim
How we protect your account and your simulation data.
Access control
- Role-based access control with least-privilege defaults.
- Production access requires SSO + 2FA for staff.
- Customer data segregated by Postgres Row-Level Security policies.
Application security
- API rate limits enforced per user and per IP.
- Dependencies audited weekly via automated scans.
- Sentry collects errors with PII scrubbing enabled.
Operations
- Daily encrypted database backups, 30-day retention.
- Quarterly access review.
- Incident response runbook with on-call rotation.
Reporting issues
- Email security@airinduct.example with details and reproduction steps.
- We acknowledge reports within 2 business days.
- Coordinated disclosure preferred; no bug bounty program at this time.