How we protect it.

We handle birth data that — while not legally classified as "sensitive personal data" in most jurisdictions — is genuinely personal. This page documents exactly how we protect it, in specifics, not vague claims.

Transport

• All site traffic on TLS 1.3 end-to-end. Certificates issued by trusted authorities (Let's Encrypt and Cloudflare) and auto-renewed.
• HSTS enabled with max-age=31536000; includeSubDomains. Once your browser talks to us once, it refuses to downgrade to HTTP.
• All traffic between our application and database is authenticated and encrypted in transit with TLS.

Storage & encryption

• Account passwords hashed with a modern memory-hard algorithm (handled by better-auth), not stored in plaintext or reversible form.
• Birth time — the most sensitive field — held in a database with server-side-only access, never exposed to the internet.
• Session tokens stored as HttpOnly, Secure, SameSite=Lax cookies. Not readable by JavaScript.
• Daily backups replicated off-site, retained 14 days on-site; snapshots cycle out within 2 years, verifiable via our rotation policy.

Infrastructure

• Application hosted on Vercel (SOC 2 Type 2, CCPA/GDPR compliant), in the United States.
• Customer data is stored in an isolated, firewalled database that only our application can reach, over an authenticated and encrypted connection.
• Cloudflare sits in front of every domain — DDoS protection, bot management, WAF rules for known attack patterns.
• Payment processing end-to-end through Stripe — we never see or store card numbers.

Application security

• Security headers on every response: CSP, X-Content-Type-Options, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, HSTS.
• Database access only via parameterized queries through drizzle-orm. No string-concatenated SQL, anywhere.
• All user input validated at the API boundary with Zod schemas before it touches application logic.
• Dependencies scanned on every deploy. CVE advisories trigger automated PR bumps within 24 hours.

Access control

• Session-based authentication via better-auth. Sessions expire after 7 days of inactivity; renew on each request.
• Password reset flow with single-use tokens that expire in 30 minutes.
• Two-factor authentication (TOTP, no SMS) is available. Enable it under Settings → Security; single-use backup codes are issued at setup.
• Internal team access to production data is role-restricted and logged.

Data protection

• Minimal data collection — we store only what readings require.
• Deletion is honoured within 7 days in production databases, 30 days in logs/analytics, 2 years in backup snapshots. See Privacy Policy.
• Your birth data and readings are never used to train any AI model — ours or a third party's.
• GDPR and CCPA rights honoured; contact us for access, correction, deletion, or portability.

Monitoring & incident response

• Automated monitoring checks core services every 5 minutes and alerts our on-call team to any disruption immediately.
• Daily automated database integrity checks before each backup.
• Confirmed security incidents trigger user notification within 72 hours, in line with GDPR Art. 33.

Responsible disclosure

Found a vulnerability? Please report it privately — don't exploit, don't publicly disclose until we've had a reasonable window to patch. We do not run a paid bounty program yet, but we do credit researchers in release notes with your permission.

Contact: support@zodiacs.ai, subject line [SECURITY]. We respond within 72 hours.