Security

1. Our commitment to security

At Sofidoo, security is a fundamental priority. We take the protection of your data very seriously and work continuously to maintain a safe and trustworthy environment for all our users. We implement multiple layers of protection following industry best practices.

2. Data encryption

2.1 Data in transit

All communication between your browser and our servers is conducted through encrypted connections using TLS (Transport Layer Security). This ensures that the information you send and receive is protected against interception during transmission.

2.2 Data at rest

Sensitive data is stored encrypted, so it cannot be read without the encryption keys, which are kept separate from the database.

3. Authentication

We use strong authentication mechanisms to protect account access:

• Secure sessions: User sessions are managed with signed, time-limited credentials.
• Protected passwords: Passwords are never stored in plain text: they are stored with a hashing algorithm designed for passwords, which makes them hard to recover.
• Attempt limits: We limit repeated sign-in attempts to make brute-force attacks harder.
• Role-based access control: Each user can only see and do what their role allows within their group.

4. Infrastructure security

Our infrastructure relies on these practices:

• Restricted access: The internal components of the system are not directly reachable from the internet.
• Protection against attacks: We have protection against malicious traffic and denial-of-service attacks.
• Regular updates: We apply security patches and updates regularly across the system components and software dependencies.

5. Vulnerability reporting

We value our users' collaboration in identifying potential vulnerabilities. If you discover a security issue on the platform, report it by creating a ticket from the Support section of your account, with the Technical category, and describe what you found.

We are committed to investigating and responding to security reports in a timely manner. We appreciate that you do not publicly disclose the vulnerability until we have had the opportunity to assess and resolve it.

6. Compliance

Sofidoo strives to comply with applicable data protection regulations, including privacy and information security laws. We periodically review our policies and practices to align with current legal requirements and industry standards.