Security at Frodito

All data transmitted between your device and our servers is encrypted using Transport Layer Security (TLS) with strong cipher suites. This applies to:

• Web application access (HTTPS)
• Mobile application API calls
• Authentication and session management
• File uploads and downloads
• Payment processing via Stripe

Your data is encrypted when stored in our systems:

• Passwords: Hashed using bcrypt with 10 salt rounds (industry-standard one-way encryption)
• Database: MongoDB with encryption at rest enabled
• File storage: AWS S3 with server-side encryption (SSE)
• Backups: Encrypted database backups

We enforce strict password requirements to protect your account:

Passwords are never stored in plain text and are hashed using bcrypt, a battle-tested cryptographic hashing algorithm designed for password security.

We use JSON Web Tokens (JWT) with a dual-token system for secure, stateless authentication:

• Access Tokens: Short-lived (15 minutes) tokens for API authentication
• Refresh Tokens: Longer-lived (7 days) tokens stored in secure HTTP-only cookies
• Automatic expiration: Tokens expire and must be renewed regularly
• Token rotation: New tokens issued on login, old tokens invalidated on logout
• Database validation: Refresh tokens validated against server records to prevent unauthorized access

Team access is controlled through granular role-based permissions:

• Owner: Full control over team settings, members, and billing
• Admin: Manage members and team settings
• Member: Access team prompts and content

Each API request is authenticated and authorized based on team membership and role before processing.

We implement sophisticated rate limiting to prevent abuse and protect service availability:

We use Helmet.js to set security-focused HTTP response headers, protecting against common vulnerabilities:

• X-Frame-Options to prevent clickjacking
• X-Content-Type-Options to prevent MIME sniffing
• Strict-Transport-Security (HSTS) to enforce HTTPS
• X-XSS-Protection for cross-site scripting mitigation
• Referrer-Policy for privacy control

All user input is validated and sanitized to prevent injection attacks:

• Email format validation using validator.js
• MongoDB ObjectId validation before database queries
• Schema-level validation with Mongoose
• Request size limits (10MB maximum) to prevent resource exhaustion
• String normalization (trimming, lowercase conversion where appropriate)
• Enum restrictions on status and type fields

Our API implements strict CORS policies with an allowlist of approved origins. Only requests from our web application (frodito.com) and authorized domains are permitted, preventing unauthorized cross-origin requests.

• HTTP-only cookies prevent JavaScript access to sensitive tokens
• SameSite cookie attribute prevents CSRF attacks
• Secure cookie flag ensures transmission only over HTTPS
• Automatic token expiration and cleanup

We minimize data retention to reduce risk and protect your privacy:

• Posts and responses: Automatically deleted after 24 hours using TTL (Time-To-Live) indexes
• Daily prompts: Automatically deleted at end of day
• Team invitations: Auto-expire after 7 days
• Session tokens: Expire after 7 days and are automatically purged

This ephemeral approach ensures that sensitive team content doesn't persist indefinitely, reducing exposure risk.

• Connection pooling (10-50 connections) for stability and performance
• Indexed fields for optimized queries and reduced attack surface
• Unique constraints on critical fields (email, payment IDs)
• No direct database access from public internet
• Regular automated backups with encryption
• Database credentials stored in secure environment variables

Team data is strictly isolated. Users can only access content from teams they're members of. All queries are filtered by team membership, and authorization checks are performed before any data access operation.

Your data is primarily stored in the European Union (AWS EU-West-1 region) to comply with GDPR and provide data sovereignty for European customers.

We never handle or store your credit card information. All payment processing is managed by Stripe, a PCI-DSS Level 1 certified payment processor — the highest level of security certification in the payments industry.

Stripe webhooks are verified using signature validation to ensure that payment events are authentic and haven't been tampered with. We validate every webhook request before processing to prevent fraudulent subscription changes.

We use industry-leading, security-certified cloud providers:

• Firewalls and network segmentation
• Private network communication between services
• No direct SSH access to production databases
• Regular security patches and updates
• DDoS mitigation at infrastructure level

In the unlikely event of a security incident:

• We have an incident response plan to quickly identify, contain, and remediate security issues
• Affected users will be notified within 72 hours as required by GDPR
• We will provide clear information about what happened and what steps we're taking
• Post-incident analysis and improvements will be implemented
• We maintain detailed security logs for forensic analysis

Our commitment is to transparency, rapid response, and continuous improvement of our security posture.

Security is a shared responsibility. Here's how you can help protect your account:

We welcome security researchers and ethical hackers to help us maintain the security of Frodito. If you discover a security vulnerability, please:

1. Email us at support@frodito.com with details of the vulnerability
2. Give us reasonable time to respond and fix the issue before public disclosure
3. Avoid accessing or modifying user data without permission
4. Do not use vulnerabilities for malicious purposes

We commit to acknowledging your report within 48 hours and keeping you informed of our progress. We appreciate responsible disclosure and will recognize researchers who help us improve our security.

Security is not a one-time effort. We continuously improve our security posture through:

• Regular security audits and assessments
• Dependency updates and vulnerability scanning
• Monitoring security advisories for our technology stack
• Team security training and awareness programs
• Penetration testing and code reviews
• Staying current with industry best practices and emerging threats