Encryption
- TLS 1.3 for all data in transit (HTTPS, API, admin).
- AES-256 at rest for databases, object storage, and backups.
- Per-account audio/video storage isolated at the object level.
Authentication & access
- bcrypt-hashed passwords with per-user salt (cost factor 12).
- JWT session tokens with 24-hour expiry.
- Optional two-factor authentication (TOTP) — coming Q3 2026.
- Row-level security: your account can only access rows tagged with your user_id.
- Admin access uses SSO + hardware keys; actions are logged for 12 months.
Network & infrastructure
- Application hosted on Railway + AWS (SOC 2 Type II certified infrastructure).
- Cloudflare edge for DDoS protection and WAF.
- Private VPC for database; no public Postgres ports.
- Secrets in AWS Secrets Manager with rotation.
AI vendor controls
| Vendor | Retention | Training | Audit |
|---|---|---|---|
| Anthropic (text) | Zero retention on API calls | Prohibited by contract | SOC 2 Type II |
| Deepgram (voice) | Zero retention on API calls | Prohibited by contract | SOC 2 |
| Stripe (payments) | Per PCI-DSS requirements | N/A | PCI-DSS Level 1 |
| Resend (email) | 30-day log retention | N/A | SOC 2 |
Application security practices
- Input validation via Pydantic schemas.
- Parameterized queries via SQLAlchemy ORM (no raw SQL from user input).
- CSRF tokens on state-changing endpoints.
- Content Security Policy (CSP) + HSTS headers on all pages.
- Dependency scanning (Dependabot) on every commit.
- SAST on every PR; secrets scanning in git hooks.
Monitoring & response
- Uptime monitoring + paging to on-call engineer.
- Incident response program with 72-hour breach notification (see DPA).
- Annual third-party penetration test.
- Responsible disclosure program — security@theheirloom.ai.
Certifications & compliance
- GDPR compliant.
- CCPA/CPRA compliant.
- PIPEDA compliant (Canada).
- SOC 2 Type II: audit in progress, target completion Q4 2026.
- HIPAA BAA available for Enterprise Partnership tier (hospice, memory care).
Responsible disclosure
Found a vulnerability? Email security@theheirloom.ai with reproduction steps. We respond within 48 hours, credit reporters in our security changelog (with permission), and offer bounties for qualifying findings:
- Critical (auth bypass, data exfiltration, RCE): $2,500–$10,000
- High (privilege escalation, sensitive data disclosure): $500–$2,500
- Medium (XSS, CSRF, information leak): $100–$500