Security

ChaozCode is built with security at its core. Learn about our security practices, compliance certifications, and how to report vulnerabilities.

Compliance & Certifications

We maintain industry-standard certifications to ensure your data is protected.

🛡️

SOC 2 Type II

Certified

Annual audit covering security, availability, and confidentiality.

🇪🇺

GDPR

Compliant

Full compliance with EU data protection regulations.

🔐

ISO 27001

In Progress

Information security management certification.

🏥

HIPAA

Compliant

Healthcare data protection (Enterprise plan).

Security Features

🔒 Encryption

All data is encrypted in transit and at rest.

  • TLS 1.3 for all connections
  • AES-256 encryption at rest
  • Perfect forward secrecy enabled
  • HSTS with 1-year max-age

🔑 Authentication

Secure access control for all accounts.

  • API keys with scoped permissions
  • OAuth 2.0 / OpenID Connect
  • Multi-factor authentication (MFA)
  • SSO via SAML 2.0 (Enterprise)

🌐 Network Security

Multiple layers of network protection.

  • DDoS protection (Cloudflare)
  • Web Application Firewall (WAF)
  • Private VPC networking
  • IP allowlisting (Enterprise)

📊 Monitoring & Logging

Comprehensive audit trails and monitoring.

  • Real-time security monitoring
  • Audit logs retained 90 days
  • Anomaly detection alerts
  • SIEM integration available

💾 Data Protection

Your data is protected and isolated.

  • Tenant data isolation
  • Daily encrypted backups
  • Point-in-time recovery
  • Data residency options (EU/US)

🧪 Security Testing

Continuous security assessment.

  • Annual penetration testing
  • Automated vulnerability scanning
  • Dependency security monitoring
  • Bug bounty program

Security Practices

Practice Details Frequency
Penetration Testing Third-party security firm conducts comprehensive pentests Annual + major releases
Vulnerability Scanning Automated scans of infrastructure and applications Weekly
Dependency Audits Automated checks for known vulnerabilities in dependencies Every build
Code Reviews Security-focused code review for all changes Every PR
Security Training Mandatory security awareness training for all employees Quarterly
Incident Response Drills Simulated security incidents to test response procedures Bi-annual
Access Reviews Review and audit of employee access permissions Quarterly
Backup Testing Verification of backup integrity and restore procedures Monthly

Vulnerability Reporting

🐛 Report a Security Vulnerability

We take security seriously and appreciate responsible disclosure. If you've discovered a security vulnerability, please report it to us privately.

  1. Email your findings to security@chaozcode.com
  2. Include detailed steps to reproduce the vulnerability
  3. Provide your assessment of the potential impact
  4. Allow up to 48 hours for initial response
  5. Work with our team to validate and address the issue

Bug Bounty Program

We offer monetary rewards for qualifying security vulnerabilities based on severity:

  • • Critical: $1,000 - $5,000 (RCE, data breach, auth bypass)
  • • High: $500 - $1,000 (significant data exposure, privilege escalation)
  • • Medium: $100 - $500 (limited impact vulnerabilities)
  • • Low: Recognition in security hall of fame

Data Handling

We follow strict data handling practices to protect your information.

📍 Data Residency

Choose where your data is stored.

  • US (us-east-1, us-west-2)
  • EU (eu-west-1, eu-central-1)
  • Asia-Pacific (ap-southeast-1)
  • Custom regions (Enterprise)

🗑️ Data Deletion

Complete control over your data.

  • Self-service data export (JSON)
  • Account deletion within 30 days
  • Backup purge within 90 days
  • Certificate of destruction available

👥 Third Parties

We carefully vet all vendors.

  • SOC 2 compliant vendors only
  • Data processing agreements
  • Annual vendor security reviews
  • Minimal data sharing principle