Security
What is in place, and what is not
This page lists controls that exist in the product today. It does not claim audits or certifications we do not hold. If your security review needs more, write to us and we will answer in writing.
Controls in place
| Area | What we do |
|---|---|
| Encryption in transit | All traffic uses HTTPS. The site sends a Strict-Transport-Security header so browsers keep using it. |
| Passwords | Stored only as bcrypt hashes (cost factor 12), never in plain text. Passwords must be at least 10 characters. |
| Sessions | The session cookie is sealed (encrypted and signed), httpOnly, marked Secure in production, SameSite Lax, and expires after 7 days. Every request checks the session against the account, so a password reset or "log out everywhere" ends all earlier sessions immediately. |
| Password reset | Reset links carry a random 256-bit token. Only its SHA-256 hash is stored. Links work once and expire after one hour. |
| Brute-force limits | Repeated failed log-ins for an email address are blocked for a window. Public forms are rate-limited per address. |
| Separation between customers | Every import, export, match and worksheet row belongs to one organization account. Queries are scoped to the signed-in organization. |
| Request protection | State-changing requests must carry a custom request header, which blocks cross-site form posts. The site sets a Content-Security-Policy, forbids framing, and loads no third-party scripts. |
| Audit log | Actions that change matches, worksheets or billing state write an audit record in the same database transaction as the change. |
| No filing credentials | DrawbackIQ never asks for your CBP or ACE credentials and has no connection to ACE. It cannot file anything on your behalf. |
Where your data lives
The application is hosted by Vercel and the database is hosted by Neon. Payment details, if billing is ever switched on, are handled by Stripe; DrawbackIQ does not store card numbers. Transactional email is sent through Resend. Ask for the current hosting region in writing and we will confirm it before you upload anything.
Backups and deletion
We rely on the backup features of our database host and do not publish a backup schedule or a recovery-time commitment. You can ask us to delete your organization's data by writing to privacy@getdrawbackiq.com. We act on verified requests within 30 days. Details, including what we may have to keep, are in the Privacy Policy.
What we have not done
- DrawbackIQ has not been audited under SOC 2, ISO 27001 or any other standard, and holds no such certification.
- There is no multi-factor authentication or single sign-on yet.
- We have not commissioned an independent penetration test.
- We do not make claims about encryption at rest beyond what our hosting providers provide by default.
Who can see your records
Your users can see your organization's records. A small number of people at Buckshot Digital Sales Inc. can reach the production database as needed to run and support the service. We use that access only to operate the service, answer a support request you send us, or meet a legal obligation.
Reporting a vulnerability or incident
Write to security@getdrawbackiq.com. Please include enough detail to reproduce the issue and do not access other customers' data. If we confirm that your records were exposed, we will tell you without undue delay and say what we know.
Security questionnaires
Send your questionnaire to security@getdrawbackiq.com. We will answer it truthfully, including with "not in place" where that is the case.
Questions for your security review?
Send them to us before you upload anything, or request early access and ask during onboarding.