Security & Data Handling
510sec · Last updated 2026-09-22
Device designs are among a manufacturer's most sensitive assets. This page states exactly what protects them today — and, just as importantly, what is not in place yet. We do not describe planned controls as if they were live.
In place today
| Control | How |
|---|---|
| Source code is never read | The product parses dependency manifests and SBOM files only. Project ZIPs are scanned in memory for known manifest filenames; no source file is opened, and nothing from a ZIP is written to disk. |
| Encryption in transit | HTTPS/TLS terminated by our hosting provider (AWS App Runner) for all traffic. |
| Password storage | PBKDF2 with a per-user salt. Plaintext passwords are never stored or logged. |
| Sessions | Signed, HttpOnly cookies with a fixed expiry, marked Secure so they are never sent over plain HTTP. |
| Cross-site request protection | Session and lead cookies are set SameSite=Lax, so a form posted from another site does not carry them. We do not implement a per-form CSRF token scheme; we say so rather than implying a control we do not have. |
| HTTPS enforced by the browser | HSTS (Strict-Transport-Security) is sent on every response, so a browser that has seen this site once will refuse to talk to it over plain HTTP. |
| Clickjacking and MIME-sniffing | X-Frame-Options: DENY and X-Content-Type-Options: nosniff on every response. Generated packs and uploaded attachments are always served as downloads, never rendered in our origin. |
| Host allow-list | Requests carrying a host header we do not serve are refused outright. |
| Rate limiting | Sign-in, registration, readiness verification, discovery requests and specification import are rate-limited per source address. This is an in-memory, per-instance limit: it raises the cost of online guessing and of hammering the routes that send email. It is not a defence against a distributed attack, and we do not present it as one. |
| Request size limits | Oversized requests are refused on the declared length, before the body is read. |
| Database | Managed PostgreSQL in a private network with no public address, TLS required for every connection, encrypted at rest, with automated daily snapshots and point-in-time recovery. |
| Generated packs & attachments | Stored in private, versioned, server-side-encrypted object storage with public access blocked at the bucket level. |
| Local-first AI | Document generation uses no AI at all. Optional prose polish defaults to a local model; cloud AI is off unless an administrator enables it. |
| Tenant separation | Every device, run and order is owned by a user id and checked on every request, server-side. |
| Payment isolation | Card data goes directly to Square. We store only an order status and reference; we never see a card number. |
| Audit log | Sign-ins, generations, purchases, admin actions and configuration changes are recorded with timestamps. |
| Least-privilege deployment | The application container holds no long-lived cloud administrator credentials. |
Not in place yet — stated plainly
| Item | Status |
|---|---|
| SOC 2 / ISO 27001 certification | Not held. Not currently in progress. We will say so the day that changes. |
| Independent penetration test of this application | Not yet performed. Planned before we market to enterprise customers. |
| Application-level encryption of stored specifications | Not added. Storage is encrypted at rest by the platform (database and object storage both), but we do not encrypt individual specifications with a separate key. |
| Customer-managed data residency | Not offered. All processing is in the United States. |
| Contractual uptime (SLA) | Not offered by default. Ask us if you need one. |
| Distributed rate limiting / WAF | Not in place. Limits are per application instance and in memory. |
| Single sign-on (SAML/SCIM) | Not built. Google sign-in is available where configured. |
On-premises option
The generation engine is deterministic and runs without internet access or API keys. For organisations that cannot send device descriptions to a hosted service, an on-premises deployment is available as a premium tier — contact us.
Reporting a vulnerability
Email support@510sec.com with "Security" in the subject. We aim to acknowledge within 2 business days and to keep you updated until resolution. Please give us a reasonable window before public disclosure; we will not pursue legal action against good-faith research that avoids privacy violations, data destruction, and service degradation.
Data deletion
Ask and we delete — account, devices, specifications and generated packs. See the Privacy Policy.