1. Our commitment
We treat security as an ongoing priority. Implemented measures include:
- Encryption: AES-256-GCM field-level encryption for sensitive data (CNP, pending passwords) with a dedicated key; TLS in transit; encryption at rest at the infrastructure level.
- Pseudonymization: IP addresses and user-agents are stored only as SHA-256 hashes.
- Access control: database Row Level Security (RLS), roles and permissions, strictly server-side service keys.
- Authentication: two-factor authentication (2FA/TOTP) available, with recovery codes.
- Abuse resistance: rate limiting on sensitive endpoints.
- Traceability: audit logging of significant actions.
- Continuity: backup and recovery.
- Testing: periodic security (penetration) testing and remediation.
2. Reporting vulnerabilities
Send reports to security@usequorify.com (or contact@usequorify.com). Include: a description, reproduction steps, potential impact and, if possible, a proof of concept. We acknowledge within 72 hours, provide an update within 14 days, and target resolution within 90 days.
3. Safe harbor for researchers
We will not pursue legal action against good-faith researchers who: report promptly and do not exploit the issue; do not access, modify or delete others' data; do not disrupt services; and follow this policy. We do not currently run a paid bug-bounty program, but the safe harbor above applies.
4. Scope
In scope: usequorify.com and subdomains, the mobile app. Out of scope: social engineering, physical attacks, denial-of-service.
5. Coordinated disclosure
We follow a 90-day coordinated disclosure policy; a different timeline may be agreed based on complexity.