Full English policy
# PeakPact Elite — Security Policy **Effective date:** 15 September 2026 **Contact:** security@peakpactelite.app ## 1. Objectives Protect confidentiality, integrity, and availability of Elite user data and service operations. ## 2. Controls - HTTPS/TLS for all public endpoints - Clerk-managed authentication; JWT audience binding (`peakpactelite`) - Secrets stored in Cloudflare Worker secrets / environment vaults — not in git - Least-privilege database roles and scoped user queries - Private R2 object access for verification media - Input validation on API routes; abuse-resistant automation compose timeouts - Dependency and Worker deploy discipline via Wrangler - Offline queue on mobile with sync only over authenticated channels ## 3. Vulnerability reporting Email security@peakpactelite.app with reproduction details. Please allow reasonable time before public disclosure. ## 4. Incident response 1. Detect / contain 2. Assess impact (personal data?) 3. Eradicate / recover 4. Notify regulators/users when legally required 5. Post-incident review ## 5. Employee / operator access Production data access is limited to operators with a need-to-know. Access is logged where platform tooling allows. ## 6. Customer responsibilities Use strong credentials, keep devices updated, and do not share verification media containing third-party personal data without rights.