Privacy and Data Security Policy

1. Security principles

• Least-privilege access and role-based administrative permissions.
• Password hashing, short-lived access credentials and revocable sessions.
• Device, IP and audit context used to detect suspicious access.
• Input validation, security headers, rate limiting and structured error handling.
• Separation of production secrets from source code and encryption for appropriate stored credentials.

2. Operational safeguards

Security controls are reviewed in proportion to service risk. Access to production data is limited to authorised purposes. Events are logged for investigation and retained according to the Privacy Notice. No security measure eliminates every risk, and this policy is not a warranty that incidents cannot occur.

3. Incident handling

Suspected incidents are assessed, contained and remediated. Affected persons and authorities will be notified when applicable law requires it. Reports should include reproducible detail and must not include unnecessary personal data.

4. Responsible disclosure

Report vulnerabilities privately to hello@vorlaxen.com. Do not disrupt the service, access unrelated accounts, retain personal data, demand payment through threats or publicly disclose an unresolved vulnerability. Good-faith reports will be assessed on their technical merits.