Security at INCLUXA
Last updated: September 21, 2026
How we protect your data — and what to do if you find a vulnerability. Security concerns: security@incluxa.com
1. Security Practices
| Area | What we do |
|---|---|
| Password storage | Argon2id password hashing, the memory-hard key derivation function recommended by OWASP and RFC 9106. Parameters are tuned to current best practice and reviewed periodically. We never store plain-text passwords. New and changed passwords are screened against the Have I Been Pwned corpus using k-anonymity: our server hashes the password and sends only the first 5 characters of its SHA-1 hash. The password itself is never sent to Have I Been Pwned. |
| Token security | RS256 asymmetric JWT tokens. Private keys never leave our servers. The browser never holds a JWT — tokens are stored in HttpOnly, Secure, encrypted session cookies (AES-256 via iron-session). |
| Email-based authentication | Verification, password reset, and team invite links are time-limited, single-use, and bound to the originating request. Because these flows rely on the security of your email account, we recommend organizations enforce MFA on the mailboxes used to access INCLUXA. |
| API key handling | API keys are stored as SHA-256 hashes only. The raw key is shown exactly once at creation. We cannot recover it — if lost, you must revoke and regenerate. |
| Tenant isolation | Tenant isolation is enforced by database-level global query filters; cross-tenant queries require an explicit, audited opt-in. |
| Data in transit | TLS 1.2 or higher enforced for all connections; TLS 1.3 preferred. HTTP traffic is redirected to HTTPS. HSTS is enabled across all customer-facing domains. |
| Audit logging | Immutable audit logs for all security-relevant actions. Logs are retained for 2 years and cannot be modified or deleted. |
| Monitoring | Azure Application Insights and Sentry monitor for anomalies and errors. Our team is alerted to unusual patterns in real time. |
| Auth rate limiting | Adaptive multi-layer rate limiting on authentication endpoints (by IP, email, account, and tenant) to defend against brute-force, credential-stuffing, and enumeration attacks. Repeated failures trigger temporary lockouts. Exact thresholds are not disclosed publicly to reduce threshold-probing risk; they are available to enterprise customers under NDA. |
| Application stack | Backend built on .NET. Portal and marketing site built on Next.js and hosted on Vercel. Primary data store is Azure SQL Database. Widget SDK delivered via Bunny CDN. All infrastructure is covered by the sub-processor list in our Data Processing Agreement. |
| Infrastructure | Hosted on Microsoft Azure. Secrets stored in Azure Key Vault and injected at runtime via managed identity. WAF, DDoS protection, and bot mitigation (Cloudflare Turnstile) via Cloudflare. Dependencies monitored by Renovate, Dependabot, npm audit and dotnet list --vulnerable; gitleaks scans for committed secrets. |
| Input validation | All API endpoints use server-side input validation. No stack traces are returned to clients — only generic error messages with a trace ID. |
2. Compliance Program
INCLUXA operates on a free-first, demand-triggered compliance posture. Our security controls are mapped to recognised free frameworks (NIST, OWASP, GDPR, ADA) and operational today. We pursue paid third-party certifications (SOC 2 Type II, ISO 27001) only when a specific enterprise customer requires one — and we will never claim a certification we have not actually received.
Current framework posture
| Framework | Scope | Status |
|---|---|---|
| NIST CSF 2.0 | Cybersecurity controls framework | Aligned — self-attested |
| NIST AI RMF | AI risk management | Aligned |
| OWASP ASVS v4.0.3 Level 2 | Application-security baseline | Self-attested |
| OWASP API Security Top 10 (2023) | API-layer defence-in-depth | Mapped |
| NIST SP 800-63B rev 3 | Digital identity / authentication | Implemented |
| GDPR Article 25 + Article 20 | Privacy by design + data portability | Implemented |
| ADA Title II + III | Accessibility (product scope) | Core product |
| EU Accessibility Act (EAA) | Accessibility (product scope) | Core product |
| ISO 27001:2022 Annex A | ISMS controls | Controls operational — not certified |
| ISO 27701 | Privacy information management (PIMS) | On our certification roadmap |
| ISO 42001:2023 | AI management system | On our certification roadmap |
| SOC 2 | Trust services (CC6.1–CC6.8 + CC7) | Audit-ready — not yet certified |
| EU AI Act | AI risk classification + human oversight | AI use-case register maintained |
| Revised Section 508 (2017) | US federal ICT accessibility | VPAT 2.x in preparation |
| COPPA (16 CFR Part 312) | School consent for educational use, per long-standing FTC COPPA guidance (K-12) | Schools tier — designed to support |
| FERPA 34 CFR §99.31(a)(1)(i)(B) | School official designation (K-12) | Schools tier — operational |
What we never claim
We do not claim to be "SOC 2 certified", "ISO 27001 certified", "ISO 42001 certified", "ISO 27701 certified", or any similar phrase that implies an external attestation we have not received. Any such claim would be misleading. If you see that language anywhere associated with INCLUXA — in our marketing, our sales conversations, or any partner material — please report it to legal@incluxa.com and we will correct it publicly.
Continuous verification
- One penetration test completed in April 2026
- Public vulnerability disclosure program (see
/.well-known/security.txt) - Immutable audit logging with 2-year retention (hash-chain, tamper-evident)
- Role-based access control (Owner, Admin, Developer, Viewer, and Teacher on Schools and Enterprise plans)
- Documented incident-response procedures: affected customers are notified within 24 hours of a confirmed breach, and supervisory authorities within 72 hours where GDPR requires
- Vendor and sub-processor risk management (see our Data Processing Agreement)
- Dependency and supply-chain monitoring (Renovate, Dependabot, npm audit, dotnet list --vulnerable, gitleaks)
- Internal Policy Pack covering 16 security and AI governance domains (available under NDA on request)
Evidence pack available on request
For enterprise vendor reviews, we can share the following artifacts under an NDA. Email security@incluxa.com with your company name and the questionnaire scope.
- NIST CSF 2.0 self-attestation (mapping of all 6 functions to live controls)
- OWASP ASVS v4.0.3 Level 2 self-attestation (control checklist with evidence pointers)
- Statement of Applicability (ISO 27001:2022 Annex A — 93 controls, applicability + status)
- Risk Register summary (top risks, residual ratings, treatment plans)
- Record of Processing Activities (ROPA — GDPR Art 30)
- Sub-processor list with DPA execution status (also published in our DPA)
- Penetration-test summary (April 2026, sanitized — severity counts + remediation status)
- 16-domain Policy Pack index (Information Security, IR, Risk, Vendor, Access, BCP/DR, SDLC, Vulnerability, Crypto, AUP, Data Classification, Breach Notification, AI AUP, AI Model Governance, AI Risk Assessment, Ethics)
- SIG Lite pre-answered questionnaire
- AI Use-Case Register + EU AI Act risk classification
- Data Protection Impact Assessment (DPIA) template
Enterprise procurement requirements? If your vendor review requires a paid third-party audit report (SOC 2 Type II, ISO 27001, ISO 42001), contact security@incluxa.com. Our controls are already aligned to these frameworks. We start a paid audit when a named customer requires one, and will give you a realistic timeline at that point.
3. Responsible Disclosure Policy
We appreciate the work of security researchers who help keep INCLUXA and our customers safe. If you discover a security vulnerability, please report it responsibly.
How to report
Email: security@incluxa.com
For sensitive reports, please request our PGP public key via email. Include:
- A description of the vulnerability and its potential impact
- Steps to reproduce the issue
- Any proof-of-concept code or screenshots (if safe to share)
- Your contact information for follow-up
What to expect
| Timeframe | What happens |
|---|---|
| Within 2 business days | Acknowledgement of your report |
| Within 10 business days | Initial assessment and confirmation of the vulnerability |
| Within 90 days | Resolution, mitigation, or an explanation if a fix is not possible |
| After resolution | Public credit in our disclosure if you wish |
Scope
In scope:
- incluxa.com (marketing + customer portal)
- api.incluxa.com (public API)
- cdn.incluxa.com (widget SDK distribution)
- The INCLUXA widget SDK
- The INCLUXA browser extension
Out of scope:
- Internal administrative interfaces (access-restricted; testing requires prior written authorization from security@incluxa.com)
- Social engineering attacks targeting INCLUXA staff
- Physical security
- Denial-of-service attacks
- Automated scanning that generates significant server load
- Vulnerabilities in third-party services (Stripe, Cloudflare, Azure, Vercel, Resend, Bunny CDN) — report those directly to the vendor
Our commitment to you
- We will not take legal action against you for good-faith research within this scope
- We will work with you to understand and validate the issue
- We will keep you updated on remediation progress
- We do not currently operate a paid bug bounty program, but we recognize researchers publicly (with consent)
4. Data Breach Notification
In the event of a confirmed data breach affecting your personal data or your customers' data, we will:
- Notify affected customers within 24 hours of confirming the breach
- Notify relevant supervisory authorities within 72 hours where the law requires (for example, GDPR)
- Provide a clear description of what data was affected, the likely impact, and measures taken
- Publish a post-incident summary once the incident is fully resolved
Schools tier. For Schools tier customers handling student education records, we commit to notifying the district within 24 hours of discovering any unauthorized access or disclosure. See Privacy Policy §12.3 and Terms §18.7 for the full FERPA breach commitments.
5. Security Contact
| Vulnerability reports | security@incluxa.com |
|---|---|
| General security questions | security@incluxa.com |
| Data breach / privacy | privacy@incluxa.com |
See also: Privacy Policy · Transparency Charter