Secure by design

Architecture and data protection

• We use encryption in transit and support at-rest encryption based on your hosting configuration and provider capabilities.
• Service-to-service traffic is protected with TLS and network-level controls.
• Access to production systems is restricted and changes are tracked to support operational security.

Identity and access management

• Role-based access in the product with admin controls for tenants.
• Least-privilege access for administrative capabilities, with periodic reviews.
• Audit logs for sensitive actions such as rewards and configuration changes.

Monitoring and vulnerability management

• Monitoring for availability, error rates, and security signals.
• Regular dependency patching, static analysis, and controlled rollouts.
• Security reviews and remediation tracking for critical issues.

Data residency and compliance

• Regional hosting options may be discussed during onboarding where applicable.
• Contracts and controls are aligned with applicable privacy and security requirements.
• Sub-processors are vetted for security posture and data handling commitments.

Business continuity

• Backups and restores depend on your hosting configuration and deployment plan.
• Incident response processes cover detection, containment, and communication.
• Change management with staged releases to reduce operational risk for frontline teams.

Contact and disclosures

Report security concerns to security@prodspur.com. We acknowledge critical issues promptly and keep you informed during remediation.