Security Posture

Our platform is a Next.js 15 application hosted on Railway with a managed PostgreSQL database, fronted by Cloudflare for DNS, TLS, and DDoS protection. Data flows are designed on least-privilege, defense-in-depth, and zero-trust principles.

• At rest. PostgreSQL database volumes on Railway use provider-managed encryption (AES-256). Object storage encrypts at rest. Database backups are encrypted.
• In transit. TLS 1.3 everywhere — public site, portals, and internal service-to-service hops. HSTS with 1-year max-age is set and we maintain eligibility for the Chromium HSTS preload list.
• Secrets. API keys and signing secrets live in environment variables scoped per environment. No secrets in source control. Rotation cadence: 90 days for high-privilege keys.

• Passwords are hashed with bcrypt (cost 12). No plaintext is ever written to logs or DB.
• Signup enforces a minimum 10-character password and checks against the Have I Been Pwned (HIBP) Pwned Passwords k- anonymity API. Breached passwords are rejected.
• Lockout: 10 failed attempts trigger a 15-minute timeout with exponential backoff thereafter.
• Multi-factor authentication is available for admin and manager roles; required for the owner.

• Session cookies are HttpOnly, SameSite=Lax, and Secure.
• Session tokens are JWT (via jose) signed with HS256 and rotated on role elevation.
• CSRF defense-in-depth: SameSite + per-origin checks on state-changing requests.
• See the Cookie Policy for the full list of cookies we set.

• Content-Security-Policy (strict script-src, no unsafe-inline in production).
• Strict-Transport-Security: max-age=31536000; includeSubDomains; preload.
• X-Frame-Options: DENY (supplemented by CSP frame-ancestors).
• X-Content-Type-Options: nosniff.
• Referrer-Policy: strict-origin-when-cross-origin.
• Permissions-Policy restricting camera, microphone, and geolocation to the portals that need them.

• Roles: HQ, MANAGER, CLEANER, CUSTOMER — enforced at middleware and API layers.
• Multi-tenant isolation via tenant-slug scoping on every DB query.
• Production database credentials are scoped read-write only for application roles; admin credentials are separate and seldom used.
• Cloud-console access is gated by SSO and MFA.

Every admin action that changes customer data, access, or financials is written to an immutable audit log with actor ID, action verb, target, tenant, and metadata. We retain audit logs for 7 years.

We offer a good-faith bounty, at our discretion, for eligible disclosures. Researcher must have complied with responsible disclosure (no public posting before remediation, no social engineering of our staff, no denial-of-service testing). Bounties typically range from $50 to $1,000 depending on severity. Safe-harbor terms are negotiated in advance.

1. Detect — automated alerts on error rates, login anomalies, DB latency, audit-log triggers.
2. Triage — on-call owner + ops within 60 minutes of detection.
3. Contain — isolate affected subsystem, rotate keys, revoke sessions.
4. Eradicate — patch, redeploy, verify.
5. Recover — restore normal operations with elevated monitoring.
6. Notify affected customers within 4 hours of confirmed impact, regulators as required under applicable law (72 hours for GDPR, in line with Fla. Stat. § 501.171 for US breach notifications).
7. Postmortem — blameless root-cause, published internally.

We conduct annual third-party penetration testing of the web application and supporting infrastructure. Vendor: [TBD — verify and retain annually]. Executive summary available to enterprise customers under NDA.

Before/after photos uploaded by cleaners are watermarked in metadata (EXIF) with cleaner ID, tenant, job ID, and timestamp — not visibly, so we can later prove chain-of-custody if a photo is disputed. We do not publicly post customer-property photos without written consent.

Commercial and HOA customers that require a mutual Non-Circumvention / Non-Disclosure Agreement may request one at legal@gogreenorganicclean.com. Our standard NCNDA is ready to countersign within 3 business days.

Security contact: security@gogreenorganicclean.com (human-read mailbox — create / monitor). See also our machine-readable security.txt at the well-known path per RFC 9116.