How we protect your work

Infrastructure Security

• HTTPS everywhere: all connections to DraftProof are encrypted with TLS 1.2+.
• Encrypted storage: documents and reports are stored in Cloudflare R2 with server-side encryption (AES-256).
• Managed hosting: our application runs on Koyeb infrastructure with network isolation, automated patching, and DDoS mitigation.

Authentication

• OAuth 2.0 sign-in: we support Google and Microsoft accounts. We never see or store your password.
• httpOnly JWT cookies: session tokens are stored in httpOnly, Secure, SameSite=Lax cookies.
• No password storage: authentication is delegated to Google and Microsoft.

Document Protection

• Encrypted at rest: all uploaded documents are encrypted in Cloudflare R2 using AES-256.
• Encrypted in transit: files travel over HTTPS from your browser to our servers and on to storage.
• User-controlled deletion: you can delete any document or report from your dashboard at any time.
• Access isolation: each user can only access their own documents and reports.

Payment Security

• Stripe handles all card data: credit card numbers never touch our servers. Stripe is PCI DSS Level 1 certified.
• Webhook signature verification: payment confirmations from Stripe are cryptographically verified before processing.
• Credit-based billing: we track a prepaid credit balance; no recurring charges or stored payment methods on our side.

Application Security

• Input validation: all user input is validated and sanitised on the server before processing.
• CSRF protection: SameSite cookie policy and state parameters in OAuth flows prevent cross-site request forgery.
• Minimal attack surface: we use a focused stack (FastAPI + React) with minimal dependencies.

Responsible Disclosure

If you discover a security vulnerability in DraftProof, we appreciate responsible disclosure. Please email security@draftproof.app with details and we will respond promptly.