Security

How we protect your data

Encryption in Transit

All connections use TLS 1.3. HTTPS is enforced for every request. HSTS is enabled with a 2-year max-age to prevent downgrade attacks.

Encryption at Rest

All data stored in Cloudflare D1 is encrypted at rest by the infrastructure provider. Database access is restricted to authorized Workers only.

Payment Security

Payments are processed by Stripe, a PCI-DSS Level 1 certified provider. We never see, store, or transmit your full credit card number or CVC.

Authentication

We use JWTs with expiration for session management. Passwords are hashed. Rate limiting prevents brute-force attacks on authentication endpoints.

Webhook Verification

Stripe webhooks are verified using HMAC-SHA256 signatures with constant-time comparison to prevent timing attacks and replay attacks.

Infrastructure

Hosted on Cloudflare's global network with DDoS protection, WAF, and edge-level rate limiting. Cloudflare Workers run in isolated V8 isolates.

Content Security Policy

Strict CSP headers restrict script execution to trusted origins. X-Frame-Options and X-Content-Type-Options headers prevent clickjacking and MIME sniffing.

Input Validation

All user input is validated and sanitized server-side. Email content is HTML-escaped before delivery. Check-in responses use idempotent operations to prevent replay attacks.

Data Storage

User data is stored in Cloudflare D1, a globally distributed relational database. Data is replicated across Cloudflare's network for availability. Database access is restricted to authenticated Worker requests originating from our service only.

Breach Notification

In the event of a data breach affecting personal data, we will notify affected users and relevant supervisory authorities within 72 hours of discovery, as required by GDPR. We maintain an incident response plan to contain, investigate, and remediate security incidents.

Responsible Disclosure

If you discover a security vulnerability in Still Here, please report it to us at [email protected]. We ask that you:

Give us reasonable time to investigate and address the issue before public disclosure.
Do not access or modify data that does not belong to you.
Act in good faith and follow responsible disclosure principles.

We take all security reports seriously and will acknowledge receipt within 48 hours.

Compliance

Still Here is designed to comply with GDPR (EU), UK GDPR, and CCPA (California). For details on data handling, see our Privacy Policy.