Security

Our Approach

Cultivation is built with security as a foundation, not an afterthought. We apply defense-in-depth across every layer of the platform — from data encryption to access controls to incident response.

Encryption

• All data encrypted in transit via TLS 1.3
• Data encrypted at rest using AES-256
• Database connections use SSL with certificate verification
• User API keys encrypted with AES-256-GCM before storage

Infrastructure

• Hosted on Vercel (SOC 2 Type II certified) and Supabase (SOC 2 Type II certified)
• Database hosted on AWS in us-east-1 region
• Automatic daily database backups with 30-day retention
• DDoS protection via Vercel Edge Network
• Environment variables stored in Vercel encrypted vault — never in code

Access Controls & Authentication

• OAuth 2.0 via Google and GitHub (no password storage by default)
• Optional password authentication with bcrypt hashing (12 rounds)
• Role-based access control (Owner, Admin, Member, Viewer)
• Demo accounts are read-only — cannot mutate production data
• Session tokens expire after 30 days of inactivity
• API rate limiting per user and per IP

Application Security

• Input sanitization on all API endpoints
• Prompt injection detection and sanitization for AI features
• Circuit breaker pattern prevents cascading failures
• Hallucination guard validates all AI outputs against real data
• Content Security Policy (CSP) headers enforced
• CSRF protection via SameSite cookies and origin checking

Incident Response

• 24-hour response SLA for security incidents
• Structured incident classification (P0–P3 severity levels)
• Post-incident review and root cause analysis for all P0/P1 events
• Affected customers notified within 72 hours per GDPR requirements

Compliance Roadmap

• SOC 2 Type II — in progress, target completion Q3 2026
• GDPR compliant — EU data subject rights fully supported
• CCPA compliant — California consumer rights supported
• Data Processing Agreement (DPA) available on request
• Annual third-party penetration testing planned

Responsible Disclosure

If you discover a security vulnerability, please report it responsibly to info@heycultivation.com. We appreciate your help in keeping our platform secure and will acknowledge reports within 48 hours.