Security & responsible disclosure

• TLS 1.3 enforced in transit; HSTS preload on `*.adaptrix.ai`.
• AES-256 at rest on Hetzner-managed encrypted volumes (Germany).
• JWT auth via GitHub OAuth only — no passwords stored.
• CSRF tokens on every mutating endpoint.
• Stripe handles all payment card data (PCI DSS Level 1).
• RLS (Row-Level Security) enforced on multi-tenant tables via `organization_id` filter.
• CSP report-only deployed; full enforce target Q3 2026.
• Daily Hetzner snapshot of PostgreSQL + AGE graph database; 30-day rolling retention.
• Annual third-party penetration testing.

We welcome reports from the security community. If you discover a vulnerability affecting FlowTrace (flowtrace.adaptrix.ai), Adaptrix infrastructure, or our published SDKs, please report responsibly via:

• Email: security@adaptrix.ai (preferred channel; we acknowledge within 24h).
• Need to encrypt your report? Request our PGP key via the same address and we will send it before you share details.

• flowtrace.adaptrix.ai (production) and staging-flowtrace.adaptrix.ai.
• API endpoints under `/api/*`.
• OAuth flow, JWT issuance, session cookie integrity.
• Multi-tenant isolation (RLS bypass attempts).
• Stripe webhook signature validation.

• Denial-of-service (DoS) attacks. Do not test.
• Social engineering of Adaptrix staff.
• Physical security of Hetzner data centers.
• Third-party services (GitHub OAuth, Stripe, Cloudflare) — report to them directly.
• Best-practice findings without demonstrable impact (e.g., missing security header on a static asset).

• Acknowledgement: within 24 hours (business days).
• Triage + initial assessment: within 5 business days.
• Fix + disclosure timeline: agreed mutually with reporter.
• Hall-of-fame credit: optional, with reporter consent.

FlowTrace does not currently run a formal paid bug bounty during beta. We will credit reporters publicly (with consent) and may award discretionary thanks (swag, Pro tier credits) for high-impact disclosures. A formal program with monetary rewards is on the roadmap for post-beta.

Machine-readable disclosure metadata follows RFC 9116 and is served at /.well-known/security.txt.