Security Standards

01 Introduction#

LeakTrace holds the email addresses and domains submitted to our checks, the results of those checks, the documents we deliver, and the account and purchase records needed to run the service. This page describes how that information is protected. Our Privacy Policy describes what we collect and your rights over it, and our Trust Centre keeps a dated record of changes.

02 Certifications#

We hold no third-party security certification today. We do not hold a SOC 2 report and no audit is underway. We have not commissioned an external penetration test of our own production environment. We are not a HIPAA business associate and do not sign business associate agreements.

We follow the Federal Trade Commission's published data security guidance and the fair information principles set out in PIPEDA. That is our own practice, not a certification or a regulator's approval.

03 Encryption#

• In transit: all traffic to our site is served over HTTPS. HSTS is set for one year, including subdomains.
• Backups: database backups are encrypted with AES-256-GCM before they are copied off our hosting provider, and the key is held outside the code repository.
• Passwords: account passwords are stored only as salted PBKDF2-SHA256 hashes, never in readable form.
• Payments: card details are entered on Stripe's payment page and never reach our systems.

04 Access Controls & Sign-In#

• Role-based access: access to customer data is limited to staff roles that need it. A customer's dashboard and documents open only with a one-time code emailed to an address on that customer's record.
• Two-step sign-in: available on accounts.
• Failed sign-ins: five failed attempts within five minutes block the originating address automatically.
• Separate production environment: production runs in its own hosted environment, separate from development machines, and every deployment is recorded by our hosting provider.

05 Review Before Release#

Every finding carries the evidence behind it: the observed output, when it was captured, and the command or public source you can use to check it yourself. Where a check cannot determine an answer, the finding says so rather than reporting a pass.

Every paid External Cybersecurity Assessment is held until a person has reviewed and approved it for release.

06 Where Data Is Stored & How Long#

• Location: our application and database are hosted in the United States.
• Retention: most of what we hold is kept until you ask us to delete it. Some records are deleted automatically, such as expired sessions, prospect details for sports-agency and family-office firms that do not engage, and the records of a partnership that ends; the Privacy Policy retention schedule lists every period. Stripe keeps payment records under its own terms.
• Deletion: email [email protected] and we delete what we hold and confirm in writing, except where the law requires us to keep something. Older encrypted backup copies are replaced in turn as new backups are made.
• Evidence: findings are disclosed only to the customer who ordered them, unless the law requires otherwise.

07 Incident Response & Breach Notification#

• Error monitoring: application errors are reported to an error monitoring service configured not to send personal information by default.
• Notification: if a breach of our own systems affects your information and creates a real risk of significant harm, we will notify you as soon as feasible and report it to the Office of the Privacy Commissioner of Canada where PIPEDA requires.
• Containment: we will contain the incident, tell you what was affected and what we changed, and record it in the Trust Centre changelog.

08 Keeping Your Account Safe#

• Use a strong, unique password and turn on two-step sign-in.
• We never ask for your password by email or phone. If a message claiming to be from us asks for one, forward it to [email protected].
• Sign out on shared devices. A sign-in session lasts up to seven days unless you sign out.

09 Contact for Security Concerns#

To report a potential vulnerability in our own systems, or for any security question, contact us directly. Reports are acknowledged within 72 hours, and we do not pursue legal action against good-faith researchers.

• Security: [email protected]
• Privacy: [email protected]
• Mail: LeakTrace Inc., 1200 Bay Street, Suite 1201, Toronto, ON M5R 2A5, Canada

10 Changes to This Page#

When a control changes, we update this page and its date, and record the change in the Trust Centre changelog.