Security & Data Handling
510sec · Last updated 2026-09-22
Device designs are among a manufacturer's most sensitive assets. This page states exactly what protects them today - and, just as importantly, what is not in place yet. We do not describe planned controls as if they were live.
In place today
| Control | How |
|---|---|
| Source code is never read | The product parses dependency manifests and SBOM files only. Project ZIPs are scanned in memory for known manifest filenames; no source file is opened, and nothing from a ZIP is written to disk. |
| Encryption in transit | HTTPS/TLS terminated by our hosting provider (AWS App Runner) for all traffic. |
| Password storage | PBKDF2 with a per-user salt. Plaintext passwords are never stored or logged. |
| Sessions | Signed, HttpOnly cookies with a fixed expiry, marked Secure so they are never sent over plain HTTP. |
| Cross-site request protection | Session and lead cookies are set SameSite=Lax, so a form posted from another site does not carry them. We do not implement a per-form CSRF token scheme; we say so rather than implying a control we do not have. |
| HTTPS enforced by the browser | HSTS (Strict-Transport-Security) is sent on every response, so a browser that has seen this site once will refuse to talk to it over plain HTTP. |
| Clickjacking and MIME-sniffing | X-Frame-Options: DENY and X-Content-Type-Options: nosniff on every response. Generated packs and uploaded attachments are always served as downloads, never rendered in our origin. |
| Host allow-list | Requests carrying a host header we do not serve are refused outright. |
| Rate limiting | Sign-in, registration, readiness verification, discovery requests and specification import are rate-limited per source address. This is an in-memory, per-instance limit: it raises the cost of online guessing and of hammering the routes that send email. It is not a defence against a distributed attack, and we do not present it as one. |
| Request size limits | Oversized requests are refused on the declared length, before the body is read. |
| Database | Managed PostgreSQL in a private network with no public address, TLS required for every connection, encrypted at rest, with automated daily snapshots and point-in-time recovery. |
| Generated packs & attachments | Stored in private, versioned, server-side-encrypted object storage with public access blocked at the bucket level. |
| AI in the product | Document generation uses no AI at all. Optional prose polish runs on OpenAI and Anthropic models hosted in Amazon Bedrock, inside our AWS account; Amazon Bedrock does not pass the text to the model makers, and every rewrite is checked against the original. |
| AI assist (optional, off by default) | Suggestions and checks that help you enter your device description. Off until the operator and your organization's owner both turn it on; a new organization starts with it off. It runs on OpenAI and Anthropic models hosted in Amazon Bedrock, inside our AWS account, in US Regions; Amazon Bedrock does not pass your content to the model makers. Nothing is sent until you tick consent for that request. Then only that request's section is sent: one harm, one answer's evidence, one paragraph, the document you supply for that suggestion, a summary of the description for the cross-step check, a run's review report for a draft answer, an advisory with its component's description, or the comparison of two runs. Each request is sent with response storage turned off; AWS may keep request data within AWS for abuse detection. Uploaded documents are read in memory and not stored. Every suggestion is accepted or dismissed by a named person, one at a time, and kept in the device's AI assistance record, which names the model that produced it. It never changes the analysis, a score or a generated document, and nothing about it appears in the submission documents. |
| Optional vulnerability lookup | Generation sends nothing anywhere. If you run the known-vulnerability lookup from a run page, the package URLs of your declared dependencies (ecosystem, name and version only) are sent to OSV.dev. You see the exact list before sending; your name, the time and the list are stored with the run. No component name, device name or description is sent. |
| Optional support-status lookup | If you run the support-status lookup from a run page, the names of your declared operating systems, runtimes and frameworks are sent to endoflife.date. The package names of your declared libraries go to their public registry: PyPI, npm, Maven Central, crates.io or NuGet. Versions are matched on our side and are not sent. You see the exact requests before sending; your name, the time and the requests are stored with the run. No component name, device name or description is sent, and every value that comes back stays a proposal until you adopt it. |
| Tenant separation | Every device, run and order is owned by a user id and checked on every request, server-side. |
| Payment isolation | Card data goes directly to Square. We store only an order status and reference; we never see a card number. |
| Audit log | Sign-ins, generations, purchases, admin actions and configuration changes are recorded with timestamps. |
| Least-privilege deployment | The application container holds no long-lived cloud administrator credentials. |
Not in place yet - stated plainly
| Item | Status |
|---|---|
| SOC 2 / ISO 27001 certification | Not held. Not currently in progress. We will say so the day that changes. |
| Independent penetration test of this application | Not yet performed. Planned before we market to enterprise customers. |
| Application-level encryption of stored specifications | Not added. Storage is encrypted at rest by the platform (database and object storage both), but we do not encrypt individual specifications with a separate key. |
| Customer-managed data residency | Not offered. All processing is in the United States. |
| Contractual uptime (SLA) | Not offered by default. Ask us if you need one. |
| Distributed rate limiting / WAF | Not in place. Limits are per application instance and in memory. |
| Single sign-on (SAML/SCIM) | Not built. Google sign-in is available where configured. |
On-premises option
The generation engine is deterministic and runs without internet access or API keys. For organisations that cannot send device descriptions to a hosted service, an on-premises deployment is available as a premium tier - contact us.
Reporting a vulnerability
Email support@510sec.com with "Security" in the subject. We aim to acknowledge within 2 business days and to keep you updated until resolution. Please give us a reasonable window before public disclosure; we will not pursue legal action against good-faith research that avoids privacy violations, data destruction, and service degradation.
Data deletion
Ask and we delete - account, devices, specifications and generated packs. See the Privacy Policy.