# Data Security Practices Source: https://support.exposure.co/en/articles/14020015-data-security-practices/ _How Exposure protects your data, content, and privacy_ * * * ## Overview Exposure takes the security of your data seriously. This article outlines the practices we employ to protect user accounts, payment information, uploaded content, and personal data across our platform. * * * ## Infrastructure & Network Security ### Hosting Exposure is hosted on **Amazon Web Services (AWS)** using Elastic Container Service (ECS). AWS infrastructure is certified across multiple compliance standards, including **SOC 1/2/3**, **ISO 27001**, and **PCI DSS Level 1**. Our production, staging, and development environments are **fully isolated** with separate credentials, encryption keys, and database instances. ### DNS & Edge Security All DNS is managed through **Cloudflare**, with the full suite of security features enabled: - **Cloudflare SSL/TLS** provides end-to-end encryption for all traffic, including custom domains - **Cloudflare DDoS protection** automatically detects and mitigates volumetric and application-layer attacks - **Web Application Firewall (WAF)** filters malicious traffic before it reaches our servers - **Bot Management** identifies and blocks automated threats at the edge - **DNSSEC** is enabled to prevent DNS spoofing and cache poisoning attacks - **Always Use HTTPS** ensures all requests are upgraded to secure connections Custom domain users benefit from **Cloudflare-issued SSL certificates**, providing the same level of encryption and protection as the primary Exposure domain. ### Encryption in Transit - All data transmitted between your browser and Exposure is encrypted via **TLS/HTTPS** - SSL is enforced at both the Cloudflare edge and infrastructure layer across all endpoints - Static assets are served through **Amazon CloudFront** over HTTPS ### DDoS & Abuse Protection - **Cloudflare DDoS mitigation** provides always-on protection at the network edge - **Rate limiting** is enforced across critical endpoints including authentication, contact forms, and data exports - An **IP blocklist** system enables rapid response to identified threats - **Request timeout protection** prevents resource exhaustion attacks * * * ## Data Encryption ### Encryption at Rest Sensitive fields stored in our database are encrypted using **AES-256-GCM** encryption. This includes profile passwords, story passwords, and third-party access tokens. All application secrets, API keys, and service credentials are stored in **encrypted credential files** protected by environment-specific master keys. These keys are managed through secure environment variables and are never committed to source code. ### Password Security - User passwords are hashed using **bcrypt**, a one-way adaptive hashing algorithm. Plaintext passwords are never stored or logged. - Password requirements follow **NIST SP 800-63B** guidelines: minimum 8 characters, maximum 128 characters. - Password reset tokens are cryptographically random and expire within **24 hours**. Tokens are automatically invalidated when your email address changes. * * * ## Payment Security ### PCI DSS Compliance Exposure uses **Stripe** for all payment processing. Stripe is a **PCI DSS Level 1** certified service provider, the highest level of payment security certification. **No credit card numbers, CVVs, or full card details are ever transmitted to, processed by, or stored on Exposure servers.** Here’s how it works: 1. Payment information is tokenized entirely on the client side using **Stripe.js** 2. Only an opaque token is sent to our servers 3. The only card-related data we store is the **last 4 digits** of your card, for display purposes only 4. All billing operations are handled directly through Stripe’s secure API ### Webhook Verification Incoming payment events from Stripe are validated before processing. Subscription status is verified against Stripe’s API before any access changes are made to your account. * * * ## Authentication & Access Control ### Account Authentication - Authentication uses **server-side sessions** stored in a secure database (not in browser cookies), with a **2-week expiration** policy - Login endpoints are protected by rate limiting: a maximum of **5 attempts per 90 seconds** per account - **Google reCAPTCHA Enterprise** is required during account registration to prevent automated abuse ### Session Security - Sessions are stored server-side, minimizing data exposed in cookies - Session cookies are marked **Secure** for HTTPS-only transmission and use the **SameSite** attribute - Sessions are fully invalidated on sign-out ### CSRF Protection **Cross-Site Request Forgery** protection is enabled across the entire application. External integrations such as payment webhooks use alternative authentication mechanisms (signature verification, token authentication) in place of CSRF tokens. * * * ## Application Security ### Input Validation - All user input is validated server-side, including format checks, length limits, and uniqueness constraints - Email addresses are validated using a dedicated library and checked against a blocklist of disposable email providers - File uploads are restricted to allowed image types (PNG, GIF, JPEG) with enforced size limits ### Injection Prevention - **SQL injection** is prevented through the exclusive use of parameterized database queries. No raw SQL with string interpolation is used anywhere in the application. - **Cross-Site Scripting (XSS)** is mitigated through automatic HTML output escaping in all templates ### Bot & Spam Protection Contact forms and subscription forms use **multi-layered protection**, including: - Honeypot fields to catch automated bots - Submission timing analysis - Content-based spam filtering - **reCAPTCHA Enterprise** score-based verification - Rate limiting on both burst and sustained submission patterns * * * ## Data Privacy & Retention ### Data Minimization Exposure collects only the information necessary to provide the service: your name, email, username, and optional profile fields. Payment credentials are managed entirely by Stripe. ### Account Deletion You can delete your account at any time from your account settings. Deletion follows a **two-stage process**: 1. **Immediate soft delete** - Your account is removed from all public queries, email preferences are cleared, and your content is no longer accessible 2. **Permanent purge** - After a grace period, all associated data is permanently and irreversibly deleted, including stories, photos, email subscribers, Stripe subscriptions, and all cached data ### Automatic Cleanup - Expired sessions are **purged daily** via scheduled background jobs - Stale push notification subscriptions are cleaned up on a daily schedule ### Data Export You can export your email subscriber lists via CSV download at any time. * * * ## Secure Development Practices - The codebase follows **Rails security best practices**, including parameterized queries, CSRF protection, automatic output escaping, and encrypted credentials - **Brakeman** (static security analysis) is used to identify potential vulnerabilities - **Bundler Audit** scans dependencies for known security vulnerabilities - **Strong Migrations** prevents unsafe database changes that could cause data loss - Sensitive parameters (passwords, tokens, keys) are **automatically filtered** from all application logs * * * ## Third-Party Services Exposure integrates with trusted, security-certified third-party services:

Service

Purpose

Compliance

Cloudflare

DNS, SSL, WAF & DDoS protection

SOC 2 Type II, ISO 27001, PCI DSS Level 1

Amazon Web Services

Infrastructure & file storage

SOC 1/2/3, ISO 27001, PCI DSS Level 1

Stripe

Payment processing

PCI DSS Level 1

Postmark

Transactional email

SOC 2 Type II

Google reCAPTCHA

Bot protection

Google Cloud security standards

Datadog

Performance monitoring

SOC 2 Type II, ISO 27001

All API keys and credentials for third-party services are stored in encrypted credential files and are never exposed in source code or logs. * * * ## Content Security - Uploaded photos are stored in **Amazon S3** with access managed through AWS IAM policies - All content is served over HTTPS through a CDN - Unpublished, password-protected, and deleted content is excluded from all public queries and endpoints - **Story-level** and **site-level password protection** allow you to restrict access to your content. These passwords are encrypted at rest. * * * ## Monitoring - **Application performance monitoring** provides real-time alerting in production - Background job processing is monitored for failures and queue health - All requests are tagged with unique IDs for traceability - Production logging operates at a level that minimizes inadvertent exposure of personal information * * * ## Need Help? If you have questions about our security practices, reach out to us at [support@exposure.co](). We’re happy to help! * * * ## Need help? Use the [Exposure contact form]().