Security

1. Data Encryption

1.1 Encryption in Transit

• TLS 1.3: All data transmitted between your device and our servers uses Transport Layer Security
• Secure Connections: All data is transmitted over HTTPS using TLS 1.2 or higher.
• Strict Transport Security (HSTS): We enforce HSTS to prevent protocol downgrade attacks.

1.2 Encryption at Rest

• AES-256: Database encryption using industry-standard Advanced Encryption Standard
• Encrypted Backups: All database backups are encrypted before storage
• Encrypted File Storage: User-uploaded content (profile pictures, etc.) encrypted in cloud storage

2. Infrastructure Security

2.1 Cloud Security

Morganize is hosted on enterprise-grade cloud infrastructure (Supabase, Firebase) with SOC 2 Type II and ISO 27001 compliance.

• Firewalls & DDoS Protection: Network-level protection against unauthorized access and attacks
• Private Networks: Databases accessible only from application servers
• Automated Backups: Daily encrypted backups with 30-day retention

3. Access Controls

• Password Protection: Passwords hashed using bcrypt with salt
• Session Management: Secure session tokens with automatic expiration
• Role-Based Access: Employees have minimum necessary permissions
• Audit Logs: All access to production systems is logged

4. Monitoring & Response

• 24/7 Logging: All system activity logged and monitored
• Intrusion Detection: Automated alerts for suspicious activity
• Incident Response: Security team notified immediately of threats
• Breach Notification: Affected users notified within 72 hours (GDPR compliance)

5. Report a Security Issue

We will respond within 48 hours and work with you to resolve the issue.

6. Contact Security Team

• Security Issues: security@morganize.com
• General Support: support@morganize.com