Security

Overview

We design Hotrail so that a mistake in one place does not expose everything. This page lists what we do today, and nothing we do not do.

Data protection

• All traffic uses TLS.
• Data is encrypted at rest by our database and hosting providers.
• API keys and webhook secrets are shown once. API keys are stored as hashes.
• Every query is scoped to your organization.
• An audit log records sensitive actions on every plan.

Access control

• Sign in with magic link or passkey, with optional two factor authentication.
• Roles limit what each team member can change.
• Staff access to production data is limited, logged and used only for support you request or to fix incidents.

Application security

• Rate limiting on public endpoints and on the API.
• Abuse filtering on sign up and public forms.
• Bundle manifests are signed with Ed25519 keys that you hold, and the plugin rejects a tampered manifest (shipping with the update API).
• Native files are rejected at upload, so a live update changes only the web layer.
• There is no third party in the update delivery path.
• Outbound webhooks are signed so you can verify them.
• Dependencies are updated regularly and checked for known vulnerabilities.

Certifications

We do not have SOC 2 or ISO 27001 yet. We publish this page, the data processing addendum and the sub-processor list, and we plan an external penetration test before the Team plan launches.

Infrastructure

We run on the providers listed on the subprocessors page. We rely on their physical and network security controls.

Incident response

If a breach affects your data we will tell you without undue delay and share what happened, what data was involved and what we are doing about it.

Report a vulnerability

Email legal@buffersoltech.com with the details and steps to reproduce. Please give us reasonable time to fix the issue before you disclose it. We will not take legal action against honest research.