Security Policy

Last updated: August 21, 2026

1. Security commitments

• End-to-end encryption for message content and replies.
• Client-side key generation and storage — keys never leave the administrator's trusted devices.
• Strict tenant isolation so one organisation cannot access another's data.
• Rate limiting and abuse controls on every public and authenticated endpoint.
• EU-based data residency with encryption at rest and in transit.
• Transparent, responsible disclosure for security researchers.

2. End-to-end encryption

Messages are encrypted in the sender's browser using AES-GCM via the Web Crypto API. The encrypted payload, and only the encrypted payload, is transmitted to our servers. We do not possess the decryption keys and cannot read message bodies, attachments, or replies.

Administrator keys are generated per device and wrapped so that a lost device cannot compromise historical messages. Each organisation's message room has its own key material, and keys are rotated according to the organisation's membership lifecycle.

3. Authentication and session management

• Administrators authenticate through password-based sessions with secure, httpOnly cookies.
• Sessions expire after 30 days of inactivity and are invalidated on sign-out.
• Anonymous senders receive short-lived session tokens that are verified server-side on every submission.
• Passwords are checked against known breached credentials (Have I Been Pwned) at sign-up and password change.

4. Database and access control

All application data is stored in a PostgreSQL database protected by Row-Level Security (RLS) policies. Every query — whether from the web app, a server function, or an edge function — is scoped to the authenticated user and their organisation.

• Organisations can only read and modify rows that belong to their own tenant.
• Members can only interact with invites and messages for their assigned organisation.
• Role-based checks enforce separation between organisation administrators, co-admins, and platform controllers.
• Encrypted message content is opaque to database administrators and support staff.

5. Infrastructure and data residency

The platform is hosted in the European Union (Ireland). All account data, encrypted message records, attachments, and backups reside in EU data centres and are processed under EU law.

• TLS 1.3 in transit for all browser and API traffic.
• Encryption at rest for database storage and backups.
• Redundant storage and automated backup schedules.
• Subdomain multi-tenancy keeps each organisation's public entry point isolated.

6. Rate limiting and abuse prevention

Public submission and invite endpoints enforce strict rate limits, including per-IP and per-organisation caps, to resist spam, brute-force attempts, and automated abuse. Alerts and automatic throttling are applied when thresholds are exceeded.

7. Content Security Policy and hardening

• A strict Content Security Policy restricts script sources, inline execution, and unsafe eval.
• Subresource Integrity is used for externally loaded assets where applicable.
• Security headers help prevent clickjacking, MIME sniffing, and referrer leakage.
• Dependencies are scanned for known vulnerabilities as part of the release process.

8. Vulnerability disclosure

If you believe you have found a security vulnerability in Suggestion Box Ai, please report it responsibly by emailing team@suggestion-box.ai with the subject line "Security: <short description>".

Please include:

• A description of the issue and its potential impact.
• Steps to reproduce, or a minimal proof-of-concept.
• Any relevant logs, screenshots, or environment details.
• Your contact information for follow-up.

We aim to acknowledge reports within 2 business days and provide a remediation timeline within 7 business days.

9. Safe harbor

We will not pursue legal action against researchers who make a good-faith effort to follow this policy, avoid privacy violations and service degradation, do not exploit a vulnerability beyond what is necessary to confirm it, and give us a reasonable opportunity to remediate before public disclosure.

Reverse engineering, decompilation, automated scraping, or republishing of source code or user data is prohibited and outside the safe-harbor commitment above.

10. Relation to the Privacy Policy

This Security Policy explains the technical and organisational measures we use to protect your data. For details on what data we collect, how we use it, and your rights under GDPR, UK GDPR, and CCPA, please read our Terms of Use & Privacy Policy.