Good Proof takes security seriously. This page outlines our security practices, controls, and responsible disclosure programme.
Good Proof is hosted on Vercel with Supabase for data storage. All infrastructure runs on TLS 1.3 encrypted connections. We use Cloudflare for DDoS protection and Web Application Firewall (WAF) capabilities. Database access is restricted via Row Level Security (RLS) policies.
All data is encrypted in transit using TLS 1.3. Data at rest is encrypted using AES-256 encryption provided by our infrastructure providers. Sensitive fields including IP addresses are hashed before storage using one-way cryptographic functions.
Administrative access is restricted to authorised personnel only. API endpoints are protected by rate limiting (via Upstash Redis), anti-junk validation, and Cloudflare Turnstile CAPTCHA verification. Service-level access uses scoped API keys with least-privilege principles.
We maintain an incident response plan covering detection, containment, eradication, and recovery. Security incidents are documented and reviewed. Affected parties are notified in accordance with applicable data protection regulations.
We regularly review and update our dependencies for known vulnerabilities. Our Content Security Policy (CSP) is configured to prevent XSS and injection attacks. All user input is validated and sanitised before processing.
Good Proof is designed with privacy and security by default. We are working towards SOC 2 Type II certification. Our practices align with GDPR and PDPA requirements. Security headers including HSTS, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy are enforced on all pages.
If you discover a security vulnerability in Good Proof, we encourage responsible disclosure. Please report it to our security team at [email protected]. We will acknowledge receipt within 48 hours and work with you to understand and address the issue.
Please do not publicly disclose vulnerabilities until we have had a reasonable opportunity to address them. We appreciate the security research community and will credit reporters who follow responsible disclosure practices.
For security questions or to report a concern, contact [email protected]. For general enquiries, visit our Contact page. See also our Trust Model.