Security

Last Updated: August 19, 2026

Security is a core requirement of the CLAJAMA platform — for our app and for the customer sites we host. This page describes the controls we operate and how to report a vulnerability responsibly.

Platform security controls

• Transport security: TLS 1.2+ everywhere with HSTS, strict Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy headers.
• Authentication: two-factor authentication (TOTP + email OTP + recovery codes), session tokens revalidated on every request, login rate limiting, CSRF protection.
• Authorization & isolation: role-based access (user/admin), per-tenant workspace isolation — customer data is never accessible cross-tenant.
• Data protection: passwords hashed, 2FA secrets and recovery codes encrypted at rest, payment data handled by PCI DSS Level 1 processor (Square) with verified webhooks.
• Application security: parameterized queries and SQL allowlists, input validation, build pipeline validation (structure, heading hierarchy, design tokens), and automated vision QA.
• Operations: nightly backups, disk and uptime monitoring with alerts, connection-leak audits, checksum-verified deploys, documented incident response.
• AI safety: prompt-injection detection, PII redaction in our pattern engine, and a strict no-training-on-customer-data policy with our AI providers.

Responsible disclosure

If you believe you have found a security vulnerability in CLAJAMA, we appreciate your help in disclosing it to us responsibly. Please:

1. Email details to security@clajama.com — include the affected URL/endpoint, steps to reproduce, and impact.
2. Do not test in a way that affects other customers (no load testing, no accessing data beyond the minimum needed to demonstrate the issue).
3. Give us a reasonable window (we aim for 5 business days to acknowledge, and we will keep you updated) before any public disclosure.

We do not offer a bounty program at this time, but we will publicly acknowledge valid, good-faith reports (unless you prefer anonymity) and fix confirmed issues promptly.

Scope

• In scope: clajama.com and *.clajama.com published sites, the web application, and public APIs.
• Out of scope: third-party services (Square, AI providers, hosting), social engineering, physical attacks, denial-of-service testing.

Contact

security@clajama.com · machine-readable contact: security.txt. See also: Trust Center · Privacy · DPA & Subprocessors.