Security

1. Program Overview

Our security program is led by a dedicated security function and reviewed by executive management. Controls are aligned with SOC 2 Type II criteria, and independent penetration tests are performed at least annually with remediation tracked to closure. All engineering staff receive security training at onboarding and annually thereafter.

2. Application Security

We follow secure-by-default engineering practices: all user-submitted content is sanitized before rendering to prevent cross-site scripting; database access goes through parameterized queries to prevent injection; no secrets or credentials are embedded in the codebase, and all external service configuration is provided via environment variables and a managed secret store.

Input validation runs on both client and server, comment submissions are length-limited and stripped of markup, and dependencies are scanned continuously with critical patches prioritized. Changes ship through peer-reviewed deployments with automated test gates.

3. Data Security

Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256. Access follows least privilege with role-based controls, unique credentials and multi-factor authentication for administrative access; administrative actions are audit-logged. Backups are encrypted, tested for restorability, and retained under documented limits.

4. Collection Ethics as Security

For a web-data company, collection ethics are part of security: public data only, respectful collection rates, robots.txt honored where applicable, no credential-walled or personal-data collection, and documented acceptable-use boundaries. Every collection program is reviewed against these boundaries before onboarding, and the Acceptable Use Policy sets out the same rules we hold ourselves to.

5. Resilience

The delivery layer is redundant across availability zones with documented recovery objectives and a practiced failover path. Source-level disruption — redesigns, outages, blocks — is handled by the same quarantine-and-alert machinery that governs data quality, so degradation is visible and bounded rather than silent.

6. Responsible Disclosure

If you discover a security issue, report it to security@heroku.tech. We acknowledge reports within one business day, keep findings confidential, and will not pursue action against good-faith research that avoids privacy violations, service degradation and destructive testing. We aim to validate and remediate within 90 days and will credit reporters in our advisories where they wish.