01Account security
The things most incidents actually turn on:
- Passwords are stored only as salted hashes, derived with a deliberately slow function. We cannot read your password, and neither can anyone who obtains the stored value.
- Sessions are cryptographically signed and verified on every request, so a session cannot be forged or altered.
- Sign-in, sign-up, and password reset are rate limited per source.
- Password reset responds identically whether or not an address has an account, so the form cannot be used to discover who has one.
02Isolation
Your workloads run in an environment that is yours. Separation is the default state for every account rather than an upgrade, so there is no configuration step that can be missed.
03Data residency
You name the jurisdictions a workload and its data may occupy, and the platform enforces that boundary. It is not a policy that depends on everyone remembering to follow it.
04Audit trail
Every administrative action is recorded with the actor, the target, and what changed. The trail is append-only from the application and exportable, so producing evidence for a review is a report you run rather than a project you staff.
05Access control
Administrative functions are authorised in two independent places, so a single missed check does not expose them. An administrator cannot change their own role or status, and only an owner can grant owner rights.
06Frameworks
Our controls are designed and operated against SOC 2, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, HIPAA, GDPR, PCI DSS, and NIST SP 800-53.
We describe these as frameworks our controls are operated against rather than as certifications held. Current attestation reports are available under mutual NDA so you can assess them directly instead of taking a badge at face value.
07Reporting a vulnerability
If you believe you have found a security issue, email security@gpuaar.com. Tell us what you found and how to reproduce it.
We will acknowledge your report, keep you updated while we investigate, and will not pursue legal action against anyone who reports in good faith, avoids privacy violations and service degradation, and gives us reasonable time to fix the issue before disclosing it.