Security

Last updated: February 7, 2022

Product Security

Development Process

We follow industry best practices, so security is baked right into our product and regular development processes including code reviews, unit & integration tests.

All engineers are required to know OWASP vulnerabilities and use libraries, frameworks, and mitigations vetted and recommended by the security community.

Vulnerability Scanning

We regularly update our servers, tools, libraries, and patching vulnerabilities as they are discovered. Our application, host, and network are automatically scanned. We also automatically detect out-of-date dependencies.

Infrastructure Security

Encryption

Data in transit runs entirely over SSL. All passwords are hashed using bcrypt and billing information is entirely managed by our PCI-compliant payments providers (Stripe and PayPal).

Secrets Management

Secrets are stored securely and never in source code. Access to our infrastructure and related services requires SSH and two-factor authentication when possible.

Monitoring and Logging

We are committed to making Preceden highly available. Our infrastructure runs on fault-tolerant systems and backups are made daily. We leverage redundant third-party providers to provide 24/7 monitoring and alerting of any downtime.

Trust and Verification

Compliance

Preceden is hosted on DigitalOcean, a cloud infrastructure provider serving customers worldwide. Preceden is deployed to DigitalOcean's New York region (NYC1). For information about data residency, see DigitalOcean's data center locations.

DigitalOcean operates SOC 2 Type II audited data centers and complies with major industry standards including:

• ISO/IEC 27001
• SOC 1 and SOC 2 / SSAE 18
• PCI DSS
• GDPR
• CCPA

Security Research

We welcome responsible security research and disclosure on our product and infrastructure. Potential vulnerabilities can be reported by emailing [email protected]. Valid findings will be considered for compensation.