SECURITY PAGE

Security & Data Protection Overview
Last updated: December 1, 2025

We take security and data protection very seriously. Below is an overview of the measures and practices we use to protect your data and ensure service integrity.

1. Infrastructure & Hosting

  • Our platform is hosted on secure, reputable cloud infrastructure providers vetted for compliance and reliability.

  • We deploy firewalls, network segmentation, DDoS protection, and intrusion-detection / prevention systems to guard against external threats.

  • We maintain regular, encrypted backups of critical data, stored in secure, geographically-redundant data centers — to ensure disaster recovery and data integrity. 

2. Encryption & Data Protection

  • All communication between clients and TrackBranded services is encrypted via TLS/HTTPS, ensuring secure data in transit.

  • Sensitive data is encrypted at rest where feasible (databases, backups), including encryption of storage volumes and database content — to protect data on disk. 

  • Passwords and sensitive credentials are hashed and salted securely; we never store plaintext passwords.

  • Sensitive keys, API tokens, or secrets are stored securely and accessed only by authorized services with limited privileges.

3. Access Control & Identity Management

  • We enforce Role-Based Access Control (RBAC) across our team, ensuring that individuals only have access to data or systems necessary for their role — following the principle of least privilege.

  • All administrative and internal accounts require strong authentication; where possible, we support or enforce Multi-Factor Authentication (MFA) for access to sensitive systems. 

  • Access privileges are reviewed regularly; unnecessary access is revoked promptly.

  • Development, staging, and production environments are logically and/or physically separated to minimize risk of accidental data exposure from testing or development activities. 

4. Application Security & Secure Development

  • We follow secure development practices: input validation, secure coding standards, automated dependency and vulnerability scanning. 

  • At regular intervals — and after major changes — we perform security reviews and vulnerability assessments; for high-risk changes we conduct code audits.

  • We maintain an internal security-review checklist covering all major application components, dependencies, and third-party integrations. 

  • Sensitive data flows and architecture are periodically reviewed with threat-modeling and risk-assessment approaches to ensure that data handling remains secure as we evolve. 

5. Monitoring, Logging & Incident Response

  • Systems are continuously monitored for anomalies, unauthorized access attempts, error spikes, or suspicious behavior.

  • We maintain detailed audit logs of access, system changes, data access — retained in a secure, immutable log store to support investigations if needed. 

  • We have a documented Incident Response Plan: in the event of a breach or security incident — detection → containment → recovery → notification — we act swiftly. Affected users will be notified where required. 

  • Backups and redundancy are part of our disaster recovery strategy, ensuring minimal downtime and data loss even in case of infrastructure failure or security events. 

6. Vendor & Third-Party Risk Management

  • We only utilize third-party providers (hosting, infrastructure, analytics, payment processors, etc.) that meet rigorous security and compliance standards.

  • All third-party services handling customer data are vetted, and we maintain a vendor-approval process and periodic reviews to re-assess their security posture. 

  • We require any sub-processor or third-party handling personal or sensitive data to operate under strict confidentiality agreements and follow data-protection best practices equivalent to our own.

7. Data Retention, Deletion & Privacy Compliance

  • We retain data only as long as necessary to provide the Service, fulfill contractual and legal obligations, or support legitimate business needs (billing, audit, support).

  • Upon user request (or after account termination), we provide data export or deletion options; backups are purged or anonymized in compliance with applicable regulations.

  • We enforce secure deletion and ensure that data is irrecoverable once deletion is completed — including deletion from backups, caches, and replicated storage.

8. Compliance, Standards & Ongoing Security Commitment

  • We strive to align with recognized security frameworks (e.g. ISO/IEC 27001/ISO/IEC 27040 controls, and best practices for SaaS security) to maintain rigorous standards for data integrity, confidentiality, and availability. 

  • Security is an ongoing process — not a one-time setup. We regularly reassess, update our security posture, apply security patches promptly, and audit our infrastructure and practices. 

  • We maintain internal security policies, staff training, access reviews, and procedural governance to minimize risks from human error or misconfiguration. 

9. Responsible Disclosure & Security Contact

If you believe you have discovered a security vulnerability or issue, please report it promptly to [email protected].
We appreciate responsible disclosures — we will respond and coordinate with you as soon as reasonably possible.