Security at AccessProof

Last updated 24 October 2026

Compliance status: SOC 2 readiness in progress. AccessProof is not SOC 2 certified/attested today; we are implementing controls aligned with the AICPA Trust Services Criteria (Security) ahead of an independent audit. We will update this page when a report is available.

Infrastructure

• Hosted on Cloudflare Workers and Durable Objects (SQLite storage, encrypted at rest by Cloudflare; TLS 1.2+ in transit, HSTS enforced).
• No servers or SSH access to manage; DDoS protection and WAF at the Cloudflare edge.
• Durable Object storage has 30-day point-in-time recovery; customers can export their data at any time.

Application security

• Passwordless sign-in via single-use, short-lived magic links; HttpOnly, Secure, SameSite session cookies.
• Strict Content-Security-Policy, X-Frame-Options DENY, nosniff, Referrer-Policy and Permissions-Policy on every response.
• Least-privilege, read-only connector scopes; revocations happen only after an explicit human decision, and every action is written to a tamper-evident audit trail.
• We store credential metadata (owner, expiry) only — never secret values.

Operations

• Every change goes through version control with automated tests in CI before deploy; dependency and secret scanning on the repository.
• Structured, redacted logs (emails masked, tokens stripped) retained 3 days; audit trail retained 400 days; automatic data purging on a daily schedule.
• Automated error alerting and a documented incident response process, including customer notification without undue delay (and within 72 hours for personal-data breaches).
• Subprocessors are listed in our Privacy Policy; see also our DPA.

Report a vulnerability

Email support@tryaccessproof.com with subject "Security report". We acknowledge within 2 business days and ask that you give us reasonable time to fix before disclosure. See also security.txt.