Security

Infrastructure

• All application data and documents are hosted in the EU (Germany), on ISO 27001-certified infrastructure (Hetzner).
• Transport encryption (TLS) everywhere; encryption at rest on all storage.
• OAuth tokens for connected systems are encrypted with AES-256-GCM before storage.
• Least-privilege access control; production access is limited and logged.

Application

• Screening evidence and reports are immutable snapshots: what you saw is what is stored.
• Report links are protected with unguessable tokens and timing-safe verification.
• Webhooks from connected systems are signature-verified.
• Per-user quotas and rate limits protect against abuse.
• New passwords are checked against known data breaches (Have I Been Pwned) using k-anonymity: only the first five characters of a hash leave our servers, never the password itself.
• Passkeys (WebAuthn): sign in with a fingerprint, face or device PIN instead of a password. A passkey cannot be phished, because the browser will not release it to a look-alike domain, and there is no code a caller can talk someone into reading out.
• Two-step verification (TOTP) with single-use backup codes, for sign-ins with an email address and password. A team owner can require it of the whole team; members who sign in with Google, Exact Online or HubSpot verify through that provider.
• E-mail addresses are verified before an account can be used, and a change to a password or to two-step verification is confirmed by e-mail to the account holder.

Disclosure

Found a vulnerability? Report it to security@cloudpliant.com. We respond quickly and appreciate responsible disclosure.