1. Infrastructure
Weisscollar currently runs production infrastructure on Amazon Web Services in the United States. We use managed cloud services where practical and separate development, staging, and production systems where appropriate.
2. Authentication and access
Authentication is handled through a dedicated identity provider. We use role-based access, environment-specific secrets, and least-privilege principles for infrastructure and service access where practical.
3. Data protection
We use HTTPS/TLS for data in transit. Sensitive credentials and API keys are kept out of source code and managed through environment configuration. Payment data is processed by Stripe; Weisscollar does not store full payment card details.
We design the product to limit unnecessary collection, but users should avoid uploading secrets, government identifiers, health data, or other sensitive information unless it is necessary for the workflow.
4. Monitoring and logging
We use operational logging and error monitoring to detect failures, rate limits, webhook issues, and application crashes. Logs are intended for debugging and security operations and should not be used as a replacement for product records.
5. Incident response
If we become aware of a suspected security incident, we may investigate, contain the issue, preserve relevant logs, rotate credentials, work with vendors, notify affected parties where legally required, and take other steps we believe are appropriate. Read the full Data Security & Incident Response policy for more detail.
6. AI and third-party services
Some user content may be processed by AI providers and other subprocessors to deliver the service. We evaluate providers for reliability, performance, and security, and we aim to minimize data exposure where possible.
7. Responsible disclosure
If you believe you found a vulnerability, please email info@weisscollar.com with enough detail for us to reproduce and understand the issue. Please do not access, modify, delete, or exfiltrate data that does not belong to you.
Please include “Security” in the subject line so we can triage it quickly.
8. No perfect security
No internet service can guarantee absolute security. We continuously improve our practices as the product matures and as new risks emerge.