Trust CenterVerified Technical Posture

Security architecture & data governance.

We believe that security credibility is built on verifiable architecture, transparent disclosures, and data minimization—not unverified compliance badges. Below is the exact technical security posture enforced across our services, proprietary products, and free utilities.

Technical Safeguards

Verified Controls & Commitments

infrastructureVerified Active

Enforced TLS 1.3 & HSTS Preloading

All client and API communication requires modern TLS with mandatory HSTS preloading headers.

Enforcement: Configured via Next.js security headers with 2-year max-age and strict-origin referrer policy.

dataVerified Active

Browser-Native In-Memory Free Tools

Free utilities (Code Review Visualizer, Token Extractor) run 100% in local browser memory with zero server transmission.

Enforcement: Zero telemetry tracking on code review inputs; no server-side logging of uploaded or pasted code.

infrastructureVerified Active

Strict SSRF & Private Network Blocklists

Server-side utility proxies reject loopback, RFC 1918 subnets, AWS metadata endpoints, and non-HTTP protocols.

Enforcement: Enforced in /api/tools/perf-scan with 5,000ms hard timeout and 256KB memory read cap.

accessVerified Active

Least Privilege & MFA Infrastructure Access

Production infrastructure and source code repositories require hardware-backed or authenticator MFA.

Enforcement: GitHub enterprise branch protection rules with signed commits and peer review requirements.

governanceVerified Active

Responsible Vulnerability Disclosure Program

We maintain a direct security channel with a commitment to acknowledge valid security reports within 24 business hours.

Enforcement: Monitored inbox at security@cmdflow.in with encrypted communication available on request.

compliancePlanned Roadmap

SOC 2 Type II Alignment Roadmap

We design our internal operational controls against the AICPA Trust Services Criteria as our enterprise footprint expands.

Enforcement: Honest disclosure: SOC 2 certification is an active organizational milestone, not an unverified existing badge.

Vulnerability Coordination

Responsible Vulnerability Disclosure Program

We welcome security researchers and community builders to report potential vulnerabilities. We review every valid submission and aim to provide an initial triage response within 24 business hours. Please do not execute destructive exploits, access other users' data, or disrupt infrastructure stability.

Designated Security InboxPGP encryption key available on request

security@cmdflow.in