Security & Data Protection

Your security and privacy are our top priorities

Encryption

All data is encrypted both in transit and at rest:

TLS 1.3: All connections use the latest TLS encryption standards
Database Encryption: Sensitive fields like API keys and credentials are encrypted using AES-256
Secure Storage: Passwords are hashed using bcrypt with unique salts
End-to-End Protection: Your data is never transmitted or stored in plain text

Data Storage

Secure Infrastructure: We use enterprise-grade cloud infrastructure hosted on Vercel and secure database providers
Database Security: Your data is stored in secure, managed database environments with encryption at rest

Platform Credentials

When you connect payment platforms (Stripe, Gumroad, Lemon Squeezy):

Application-Level Encryption: All API keys and secrets are encrypted using AES-256-GCM with unique keys before storage
Defense in Depth: Multiple layers of encryption protect your credentials (application-level, database-level, and disk-level)
Minimal Permissions: We only request the minimum necessary API scopes
Read-Only Access: Where possible, we use read-only API keys
Secure Transmission: Credentials are never logged or transmitted to third parties
Revocable Access: You can disconnect platforms and revoke access at any time

Access Controls

Authentication: Secure session management with NextAuth.js
Authorization: Role-based access control ensures users only see their own data
Session Security: Automatic session expiration and secure cookie handling

Application Security

Secure Development: We follow security best practices in application development
Regular Updates: Dependencies and security patches are regularly updated
Input Validation: All user inputs are validated and sanitized to prevent common vulnerabilities

Privacy & Payments

We respect data protection regulations and secure payment handling:

Data Protection: We follow principles aligned with GDPR and CCPA, including user data rights and consent
Payment Security: We never store credit card data; all payments are processed through certified providers (Stripe, Gumroad, Lemon Squeezy)
Transparency: We provide clear privacy policies and terms of service

Your Data Rights

You have control over your data:

Data Access: Request information about what data we have about you
Data Deletion: Request complete deletion of your account and data by contacting support
Data Updates: Update or correct your personal information through your account settings

Security Incidents

In the event of a security incident, we are committed to:

Notifying affected users as quickly as possible
Investigating and addressing the issue
Implementing necessary corrective measures
Complying with applicable breach notification laws

Best Practices for Users

Help us keep your account secure:

Use a strong, unique password for your account
Never share your account credentials
Keep your platform API keys secure and don't share them
Regularly review your connected platforms
Log out from shared or public computers
Report any suspicious activity immediately

Responsible Disclosure

We welcome security researchers and users to report security vulnerabilities responsibly:

Email: support@affiliatemanager.us (Subject: SECURITY)
Response Time: We strive to respond to security reports within 24-48 hours
Acknowledgment: We recognize security researchers who responsibly disclose vulnerabilities

Please do not publicly disclose vulnerabilities until we have had a chance to address them. We commit to working with you to understand and resolve the issue promptly.

Questions or Concerns?

If you have security concerns or questions about our data protection practices:

Email: support@affiliatemanager.us

For immediate security incidents, please mark your email as "URGENT - SECURITY" in the subject line.

Back to Home