Security Policy

Interpretation and Definitions

Data Center Security & Server Locations

• •The Service operates on servers located in world-class data centers in the United States.
• •Physical access to these facilities is restricted by 24/7 monitoring, biometric authentication, and other industry-standard protections.
• •Distributed denial-of-service (DDoS) mitigation measures are in place at all data centers.
• •While We maintain disaster recovery and continuity measures, We do not maintain a formal continuity plan for catastrophic, low-probability events such as nuclear incidents.

Protection from Data Loss and Corruption

• •User accounts are logically segregated to prevent overlap or data corruption.
• •The Service's infrastructure includes network firewalls, intrusion detection and prevention systems (IDS/IPS), and traffic monitoring controls.
• •Account data is mirrored and backed up regularly to secure off-site locations.

Application-Level Security

• •StatCrowd account passwords are hashed and cannot be viewed by Company personnel. Lost passwords must be reset.
• •All login and application traffic is encrypted using TLS 1.2 or higher.
• •Brute force protection is implemented on login endpoints.
• •Regular external and internal penetration testing is conducted, covering infrastructure, application vulnerabilities, and simulated social engineering attacks.
• •Identified vulnerabilities are remediated promptly. Test findings are confidential and not shared externally.

Internal IT Security

• •Company offices are secured through keycard and biometric access.
• •Office networks are segmented and centrally monitored.
• •An internal security team continuously assesses vulnerabilities, conducts penetration testing, and runs social engineering drills.

Employee Security & Safeguards

• •Employees receive ongoing training in security awareness, including identifying phishing and social engineering attempts.
• •Personnel with access to customer data undergo background checks prior to employment.
• •All employees and contractors are required to sign Non-Disclosure Agreements (NDAs) and complete training on the Company's Code of Conduct and security policies.
• •The Company maintains comprehensive insurance coverage, which includes, but is not limited to, cyber liability, data privacy incidents, errors and omissions, and business interruption.

Safeguarding Your Account

While the Company maintains extensive safeguards, account security also depends on You.

• •Accounts may be suspended automatically if suspicious login activity is detected.
• •Automated monitoring and human review processes detect anomalous account behavior.
• •Certain account changes, such as password resets, trigger email notifications to the account owner.

Privacy and Compliance

• •The Company's privacy team works with product and engineering teams to ensure compliance with applicable data protection and anti-spam laws.
• •We regularly review and update the terms and conditions that govern our relationship with You.
• •The Company is committed to compliance with applicable data protection regulations and to providing tools that help customers meet their own compliance requirements.

Responsible Disclosure Program

The Company encourages responsible reporting of potential security vulnerabilities affecting the Service. This program is intended to improve security but does not constitute a public bug bounty, and no compensation is offered for submissions.