Security at Profitroommod
How we protect your Profitroom API credentials, your account data and your module configuration from unauthorised access.
API credential encryption
Your Profitroom API key is stored at rest with symmetric AES-256 encryption. The encryption key is kept separate from the data in a dedicated key management system. API keys are never logged in clear text.
TLS 1.3 in transit
Every communication between your browser, the Profitroommod platform and the Profitroom API uses TLS 1.3. Earlier TLS versions are not accepted. HSTS is enabled on the profitroommod.org domain.
Access controls
Staff access to production systems follows the principle of least privilege. Support can view account metadata and billing data but cannot see API keys in clear text. Access to production data requires two-factor authentication.
Security testing
Profitroommod undergoes an annual penetration test by an independent security firm. Critical vulnerabilities are fixed within 72 hours. High-severity findings within 14 days.
Incident response
In the event of a security incident affecting personal data, affected customers are notified without undue delay and within 72 hours when GDPR requires it. A public incident report is published within 30 days.
Responsible disclosure
Spotted a vulnerability? Write to security@profitroommod.org with the details. We reply within 24 hours and credit researchers who report valid findings responsibly.