Security Policy
Purpose
Appsations Inc. is committed to protecting client, tenant, user, business, and operational data through practical security controls, encryption, access control, monitoring, and responsible incident response.
Security principles
We aim to collect only what is reasonably needed, protect sensitive data by default, use least-privilege access, separate public and private data where practical, and design systems so one mistake or exposed credential does not expose all client data.
Data classification
AppSite data should be treated as public data, internal data, confidential data, or highly sensitive data depending on the risk of disclosure and the type of information involved.
Firebase and Firestore baseline
Where Firebase or Firestore is used, Firebase Authentication should be used for identity where appropriate, Firestore Security Rules should deny access by default, users should only access records they own or are authorized to access, and admin access should be role-based and limited.
Encryption
All public websites, APIs, apps, admin tools, and cloud services should use HTTPS/TLS. Cloud-hosted databases and storage should use provider encryption at rest. Provider-managed encryption is a baseline safeguard, not a zero-knowledge or end-to-end encryption model.
For confidential or highly sensitive data, AppSite should encrypt selected fields before upload where practical, so Firestore stores ciphertext rather than readable client content.
Encryption master keys should not be stored in Firestore, Firebase Remote Config, public client-readable storage, public app code, or source control.
Authentication and access control
Systems should use strong authentication controls, unique accounts, multi-factor authentication for administrators where practical, session expiration for admin tools, no shared administrator accounts, and immediate access removal when a role ends.
Logging and monitoring
Systems should log security-relevant activity such as sign-ins, sign-in failures, admin actions, permission changes, failed access attempts, security rule changes, data export events, and suspicious API activity. Logs should avoid storing private content or secrets.
Secure development
Repositories must not contain API secrets, Firebase service account JSON files, private keys, production environment files, unredacted client exports, or sensitive logs.
Incident reporting
Report suspected incidents to paul@appsationsinc.com.
Breach response
When an incident occurs, AppSite should confirm and contain the issue, preserve logs, disable exposed credentials, identify affected data and users, assess legal notification obligations, notify affected users or regulators when required, document the event, and improve controls to reduce recurrence.