Security

Security, stated plainly.

We don't have a SOC 2 certificate to wave at you, so here's what we actually do — and what we don't claim.

What we do

• Authentication on non-public endpoints: API keys or admin tokens guard everything that isn't designed to be public.
• Encryption in transit: the service is deployed behind TLS (HTTPS) — we never recommend running it on plain HTTP in production.
• Input validation: every endpoint validates and size-limits its inputs; errors are structured, never stack traces.
• Structured logging: operational logs for reliability and incident response — no sensitive payloads in logs.
• Fail-closed configuration: if an auth secret isn't configured, protected endpoints refuse traffic rather than opening up.
• API keys are bearer credentials — store them server-side and rotate them if exposed. Keys are stored only as SHA-256 hashes, and Stripe/provider webhook endpoints verify HMAC signatures and fail closed (503) while their secrets are unconfigured.
• All configuration is environment-driven; no secrets are hardcoded in the service.
• Deploy behind TLS (HTTPS) — the service is designed to sit behind nginx/Caddy or a load balancer.
• Verification logs hold check metadata (method, threshold, result, timestamp). Data retention and minimization policies are set before production launch.

What we don't claim

• No SOC 2, ISO 27001, or other certifications — yet. We'll pursue them when customer demand justifies it, and say so here when we do.
• No security practice is a guarantee. We describe controls, not outcomes.

Report a vulnerability

Email don+verifyage@lifeofmorr.com with "security" in the subject. We'll acknowledge within 2 business days and keep you posted on the fix.