Security Policy

Introduction

At Warranlytics, security is not just a feature - it's the foundation of everything we do. We understand that you're trusting us with valuable warranty data and business information, and we take that responsibility seriously.

This security policy describes the technical and organisational measures we use today to protect your information.

We describe only controls that are in place. Warranlytics does not hold SOC 2, ISO 27001 or PCI DSS certification.

1. Data Protection

We protect your data with several layers of controls: HTTPS for all traffic, permission checks on every request, and audit logs of changes to your records.

Passwords and session tokens are never stored in plain text, and email addresses and phone numbers are masked in our application logs.

• HTTPS for all traffic through Cloudflare, with HTTP Strict Transport Security (HSTS)
• Passwords hashed with bcrypt
• Refresh tokens stored only as SHA-256 hashes
• Session tokens held in httpOnly, Secure, SameSite cookies
• Email addresses and phone numbers masked in logs
• Data export and deletion on request

2. Access Control

We implement strict access controls based on the principle of least privilege. Users are granted access only to the data and functionality required for their specific role.

Sign-in is protected by rate limiting and short-lived access tokens with rotating refresh tokens. Two-factor authentication is not yet available.

• Role-based access control (RBAC)
• Short-lived access tokens with refresh-token rotation
• Audit logs of changes to warranties, claims, invoices and other records
• Every query scoped to your own organisation's data
• Rate limiting on sign-in, password reset and one-time-code requests

3. Network Security

All production traffic passes through Cloudflare, including its web application firewall, before it reaches our servers, and our database ports are never exposed to the internet.

Every request is authenticated and checked against role-based permissions before it can reach your data.

• Cloudflare web application firewall (WAF)
• Security headers on every response, including HSTS and a Content Security Policy
• Isolated container networks for each environment
• Database ports never exposed in production
• DDoS mitigation through Cloudflare
• Cross-origin requests limited to our own applications

4. Infrastructure Security

The platform runs in containers on managed cloud infrastructure, behind Cloudflare. Containers run as a non-root user, and each environment is isolated from the others.

We keep dependencies and base images up to date and apply security patches as they are released.

• Managed cloud hosting behind Cloudflare
• Containers run as a non-root user
• Dependencies and base images kept up to date
• Deployments defined in version-controlled configuration
• Application logging and availability monitoring
• Secrets supplied through the environment, never committed to code

5. Application Security

Our applications follow secure coding practices, with security controls at several layers of the application.

Every request is validated and sanitised at the API boundary, dependencies are kept up to date, and reported vulnerabilities are patched promptly.

• Code review and automated linting on every change
• CSRF protection on every state-changing request
• Unknown request fields rejected by strict input validation
• Secure input validation and sanitization
• Secure error handling and logging
• API security and rate limiting

6. Fraud Prevention

Fraud checks are deterministic rules applied to every warranty claim: we check for duplicate registrations and claims, confirm the serial number is valid, and confirm the claim falls inside the warranty's coverage window.

Claims that fail a check are flagged for your team to review. No machine learning or automated profiling is involved.

• Duplicate registration and claim detection
• Serial number validation
• Coverage and expiry window checks
• QR codes and signed verification links on warranty certificates
• Audit trail on every warranty and claim
• Flagged claims held for manual review

7. Incident Response

We have a documented process for handling security incidents: establishing what happened, limiting the impact, and fixing the cause.

We respond to security incidents as soon as we become aware of them, following documented procedures to limit their impact and notifying affected customers.

• Documented incident response procedures
• Rate limiting and firewall rules to contain abuse
• Server-side logs and audit trails to establish what happened
• Communication and incident notification
• Post-incident root cause analysis
• Continuous process improvement

8. Compliance and Data Protection

We build to established security practices and design the platform around the data protection obligations that apply to our customers.

We keep internal records and audit logs sufficient to evidence our GDPR obligations, and we can provide them on request.

• GDPR compliance for data protection
• Encryption in transit and at rest
• Role-based access control on every record
• Server-side audit logging of data access
• Documented incident response process
• Least-privilege access reviews

9. Employee Security Training

Everyone on our small team who can access production systems is briefed on our security practices when they join.

Access to production systems is limited to the people who need it to run the service.

• Security briefing for everyone with production access
• Production access limited to those who need it
• Secrets kept out of source code
• Guidance on handling customer data
• Incident response procedures
• Access removed promptly when someone leaves the team

10. Third-Party Security

We keep the number of subprocessors deliberately small and rely on established providers for hosting, email delivery, and file storage.

Each provider is granted access only to the data it needs to perform its function, and we can supply our current subprocessor list on request.

• A deliberately small set of subprocessors
• Contractual security agreements
• Each provider limited to the minimum data it needs
• Current subprocessor list available on request
• Data processing requirements
• Incident notification and response procedures

11. Security Reporting

We encourage responsible disclosure of security vulnerabilities and maintain clear channels for security researchers and users to report issues.

All security reports are taken seriously and investigated promptly.

• Responsible disclosure by email to contact@warranlytics.com
• Reports acknowledged and investigated promptly
• Incident escalation procedures
• Fixes prioritised by severity
• Transparent resolution communication
• Security improvements based on feedback

12. Contact Information

For security inquiries, to report security vulnerabilities, or to request additional information about our security practices, please contact us:

Email: contact@warranlytics.com

For urgent security matters, email us with the subject line 'URGENT - Security', or call +880 1811 955 677 during business hours.