Security

Last updated: 2026-07-29

This page describes the current security posture of the SeafloorSpeciesmapper platform. It's kept honest about what we have and what we don't. If you spot a security issue, report it to [email protected].

Company profile

SeafloorSpeciesmapper is operated by SeafloorSpeciesmapper LLC, a Wyoming limited liability company with a single member. There is no admin team, no offshored operations, and no third-party support agents with system access. All infrastructure is administered by the company's sole member.

Data protection

Encryption in transit. TLS 1.3 on all endpoints. HTTP is redirected to HTTPS. HSTS is enabled with a preload directive.

Encryption at rest. AES-256 on all databases, object storage, and backups.

Password hashing. Argon2id (memory-hard, resistant to GPU brute force) via the passlib library. Legacy bcrypt hashes are transparently upgraded to argon2id on next login.

Secrets management. Production secrets are stored as encrypted environment variables in our deployment platform. Nothing lives in the repository.

Data segregation. Every query is scoped to the caller's organisation via row-level checks in the API. Cross-tenant reads are structurally impossible for envelopes, runs, projects, and credentials.

Access control

Authentication. Email + password with argon2id hashing. JWT session tokens signed with HS256 and rotated every 24 hours. Password reset tokens are separate short-lived JWTs with a purpose claim.

Administrative access. Restricted to the sole member's account, protected by hardware-backed multi-factor authentication.

API access. All non-public endpoints require a valid JWT. Rate limiting is enforced at the CDN (Cloudflare) layer.

Application security

Dependency management. Backend dependencies pinned in requirements.txt. R packages pinned by version. pip audit and renv::status() reviewed before every release.

Input handling. All user input passes through Pydantic validation before touching the database. Uploaded files are validated by content-type and size before processing.

SQL injection. All database queries use parameterised placeholders (asyncpg). No string concatenation ever touches SQL.

CSRF. Not applicable — the API is a JSON-only backend authenticated via bearer tokens, not cookies.

XSS. The dashboard renders user content via safe DOM APIs (textContent, not innerHTML) except where content is explicitly marked as HTML by our own code.

Infrastructure

Hosting. Compute + storage on Fly.io, database on Supabase, CDN + DDoS protection on Cloudflare. All US-based by default; EU-West optional for Enterprise.

Backups. Nightly automated PostgreSQL backups, retained 30 days. Object storage versioned.

Monitoring. Server logs retained 30 days. Uptime monitoring via UptimeRobot.

Incident response. The sole member is on-call 24/7. Notification of security incidents to affected customers within 72 hours (see the DPA).

Vulnerability disclosure

We welcome reports from security researchers. Email [email protected] with:

• A clear description of the vulnerability.
• Reproduction steps.
• The scope of impact.

We commit to:

• Acknowledging your report within 3 business days.
• Providing a status update every 7 days.
• Not pursuing legal action against good-faith researchers who follow this policy.

We do not currently offer a paid bug bounty. We will publicly credit researchers who wish to be named.

What we don't have yet

Being honest about the gaps:

• SOC 2. No SOC 2 attestation. Planned for year two.
• ISO 27001. No plans in year one.
• HIPAA / FedRAMP / IL5. Not applicable to our data type.
• Penetration test. No third-party pentest yet. Planned before we onboard our first Enterprise customer.
• Bug bounty. No paid programme. Vulnerability disclosure is welcomed as above.

If your procurement requires any of the above, contact [email protected] and we'll discuss.

Contact

Security reports: [email protected] General questions: [email protected]