1. Overview
Our platform is a Next.js 15 application hosted on Railway with a managed PostgreSQL database, fronted by Cloudflare for DNS, TLS, and DDoS protection. Data flows are designed on least-privilege, defense-in-depth, and zero-trust principles.
2. Encryption at rest & in transit
- At rest. PostgreSQL database volumes on Railway use provider-managed encryption (AES-256). Object storage encrypts at rest. Database backups are encrypted.
- In transit. TLS 1.3 everywhere — public site, portals, and internal service-to-service hops. HSTS with 1-year max-age is set and we maintain eligibility for the Chromium HSTS preload list.
- Secrets. API keys and signing secrets live in environment variables scoped per environment. No secrets in source control. Rotation cadence: 90 days for high-privilege keys.
3. Authentication & passwords
- Passwords are hashed with bcrypt (cost 12). No plaintext is ever written to logs or DB.
- Signup enforces a minimum 10-character password and checks against the Have I Been Pwned (HIBP) Pwned Passwords k- anonymity API. Breached passwords are rejected.
- Lockout: 10 failed attempts trigger a 15-minute timeout with exponential backoff thereafter.
- Multi-factor authentication is available for admin and manager roles; required for the owner.
4. Session tokens & cookies
- Session cookies are
HttpOnly,SameSite=Lax, andSecure. - Session tokens are JWT (via
jose) signed with HS256 and rotated on role elevation. - CSRF defense-in-depth: SameSite + per-origin checks on state-changing requests.
- See the Cookie Policy for the full list of cookies we set.
5. HTTP security headers
- Content-Security-Policy (strict script-src, no unsafe-inline in production).
- Strict-Transport-Security: max-age=31536000; includeSubDomains; preload.
- X-Frame-Options: DENY (supplemented by CSP frame-ancestors).
- X-Content-Type-Options: nosniff.
- Referrer-Policy: strict-origin-when-cross-origin.
- Permissions-Policy restricting camera, microphone, and geolocation to the portals that need them.
6. Principle-of-least-privilege IAM
- Roles:
HQ,MANAGER,CLEANER,CUSTOMER— enforced at middleware and API layers. - Multi-tenant isolation via tenant-slug scoping on every DB query.
- Production database credentials are scoped read-write only for application roles; admin credentials are separate and seldom used.
- Cloud-console access is gated by SSO and MFA.
7. Audit log
Every admin action that changes customer data, access, or financials is written to an immutable audit log with actor ID, action verb, target, tenant, and metadata. We retain audit logs for 7 years.
8. Vulnerability disclosure
If you believe you have found a security vulnerability, please email security@gogreenorganicclean.com. Encrypt sensitive details with our PGP key [verify key to publish]. Please provide:
- A description of the issue, affected URL, and reproduction steps.
- Screenshots, videos, or proof-of-concept (do not attack other users' data).
- Your contact preference for coordination.
We acknowledge within 3 business days and commit to a status update every 7 business days until the issue is closed.
9. Bug bounty
We offer a good-faith bounty, at our discretion, for eligible disclosures. Researcher must have complied with responsible disclosure (no public posting before remediation, no social engineering of our staff, no denial-of-service testing). Bounties typically range from $50 to $1,000 depending on severity. Safe-harbor terms are negotiated in advance.
10. Incident response
- Detect — automated alerts on error rates, login anomalies, DB latency, audit-log triggers.
- Triage — on-call owner + ops within 60 minutes of detection.
- Contain — isolate affected subsystem, rotate keys, revoke sessions.
- Eradicate — patch, redeploy, verify.
- Recover — restore normal operations with elevated monitoring.
- Notify affected customers within 4 hours of confirmed impact, regulators as required under applicable law (72 hours for GDPR, in line with Fla. Stat. § 501.171 for US breach notifications).
- Postmortem — blameless root-cause, published internally.
11. Penetration testing
We conduct annual third-party penetration testing of the web application and supporting infrastructure. Vendor: [TBD — verify and retain annually]. Executive summary available to enterprise customers under NDA.
12. Watermarked customer photos
Before/after photos uploaded by cleaners are watermarked in metadata (EXIF) with cleaner ID, tenant, job ID, and timestamp — not visibly, so we can later prove chain-of-custody if a photo is disputed. We do not publicly post customer-property photos without written consent.
13. NCNDA for corporate clients
Commercial and HOA customers that require a mutual Non-Circumvention / Non-Disclosure Agreement may request one at legal@gogreenorganicclean.com. Our standard NCNDA is ready to countersign within 3 business days.
14. Contact security
Security contact: security@gogreenorganicclean.com (human-read mailbox — create / monitor). See also our machine-readable security.txt at the well-known path per RFC 9116.
