Security, Privacy & Procurement Trust
A comprehensive, transparent disclosure of the technical security architecture, sub-processors, data retention schedules, and GDPR Data Processing Addendum (DPA) commitments governing Danesh Habibi's digital infrastructure and commercial software platforms (including R3CON Autonomous Security and Crypto Scouter Intelligence).
100% Client-Side Tools
All developer utilities under /tools operate purely inside your browser runtime with Web Crypto. Zero cryptographic material, hashes, or tokens are ever sent to our servers.
Isolated Sovereign Infrastructure
Primary API runtime and database clusters reside exclusively in Falkenstein, Germany (Hetzner Online GmbH) within sovereign EU jurisdiction, governed natively by GDPR.
Cryptographic Defenses
Database tokens encrypted at rest via AES-256-GCM, automated daily backups encrypted with AES-256-CBC, CAA DNS pinning, and nonce-based strict Content Security Policies.
1. Authorized Sub-Processors & Infrastructure Vendors
In accordance with GDPR Article 28(2), the following third-party infrastructure and service providers process limited categories of customer or application data under formal Data Processing Agreements.
Edge Network, WAF & Storage • Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA)
Primary Infrastructure & Compute • Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany)
Payment Processing & Billing • Stripe Payments Europe, Ltd. (1 Grand Canal St Lower, Dublin 2, Ireland) / Stripe, Inc. (USA)
Application Error Telemetry • First-Party Managed Service on monitor.s1rbl4ck.com
Cookieless Web Analytics • Umami Software, Inc.
Transactional SMTP Email • Infomaniak Network SA (Rue Eugène-Marziano 25, 1227 Les Acacias, Geneva, Switzerland)
Delegated Authentication (SSO) • GitHub Inc. (USA), Google LLC (USA), Canva UK Ltd (UK), Spotify AB (Sweden)
Developer Metrics Sync • WakaTime LLC (San Francisco, CA, USA)
2. Data Retention & Lifecycle Disposal Schedule
We adhere strictly to the principle of data minimization (GDPR Article 5(1)(c) & (e)). Data is preserved only for the necessary duration required by operational necessity or statutory fiscal mandate.
| Data Classification | Retention Window | Disposal & Invalidation Method |
|---|---|---|
| Active Authentication Sessions | 30 days rolling inactivity | Automated database TTL purge and token cryptographic invalidation upon expiry or manual revocation. |
| Registered User Accounts | Duration of active account lifecycle | Permanent deletion within 72 hours of user self-service deletion request or DPA erasure notice. |
| Fiscal Orders & Invoicing Records | 10 Years (Mandatory Statutory) | Secure encrypted archival with restricted access strictly reserved for statutory tax compliance audits. |
| Contact & Procurement Inquiries | 12 months from last interaction | Manual quarterly review and secure cryptographic deletion of completed communications. |
| Encrypted Database Backups | 7 daily, 4 weekly, 6 monthly snapshots | AES-256 encrypted archives in private R2 bucket automatically expired via Cloudflare lifecycle rules. |
| Security & Operational Audit Logs | 90 days rolling | Automated log rotation and truncation via systemd journald and Docker daemon policies. |
| Client-Side Developer Tools (/tools) | 0 seconds (Zero Retention) | Ephemeral memory processing only. All data remains in browser memory and is never transmitted or stored. |
3. Technical & Organizational Security Controls Matrix
Detailed technical security measures deployed in production under GDPR Article 32 to guarantee confidentiality, integrity, availability, and resilience.
TLS 1.2 and TLS 1.3 only with forward-secrecy cipher suites. HSTS enforced with max-age=63072000 (2 years), includeSubDomains, and preload flag.
DNS CAA resource records pin certificate issuance exclusively to Let's Encrypt (letsencrypt.org) with strict validation checks.
Strict CSP with cryptographic per-request nonces, 'strict-dynamic', frame-ancestors 'none', and restricted connect-src endpoints.
Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin headers isolate browsing contexts.
OAuth access and refresh tokens, downstream API credentials, and sensitive configurations are encrypted with AES-256-GCM prior to MongoDB persistence.
Better-Auth administrative role checks enforce strict server-side authorization guards (requireRoles('admin')). Administrative sessions mandate 2FA.
Daily automated database backups are encrypted with OpenSSL AES-256 before transport and stored in a private, non-public Cloudflare R2 bucket.
All developer and security tools hosted under /tools execute exclusively in local browser JavaScript using Web Crypto API.
4. Data Subject Rights & Enterprise DPA Execution
Guaranteed legal pathways for enterprise procurement risk assessments and individual rights fulfillment under Chapter III of the GDPR.
Registered users can inspect their active sessions, update their account metadata, or execute complete account deletion directly from the authenticated User Portal (/portal/user).
- Right to Access (GDPR Art. 15)
- Right to Rectification (GDPR Art. 16)
- Right to Erasure / "To Be Forgotten" (GDPR Art. 17)
- Right to Data Portability (GDPR Art. 20)
For corporate clients deploying R3CON Enterprise or retaining bespoke security consulting services requiring formal controller-to-processor processing terms:
We provide our standard GDPR Article 28 DPA incorporating the European Commission Standard Contractual Clauses (SCCs). Turnaround time for countersigned execution is within 2 business days.
5. Incident Response & Vulnerability Disclosure (RFC 9116)
Our breach response commitments and machine-readable vulnerability disclosure contact standard.
Breach Notification Protocol (GDPR Art. 33 & 34)
In the event of a verified personal data breach impacting customer confidentiality or integrity, we commit to notifying the relevant supervisory authority (Garante per la protezione dei dati personali) within 72 hours of confirmation, alongside immediate direct notification to impacted account owners.
Coordinated Vulnerability Disclosure
We welcome responsible disclosures from ethical security researchers. In accordance with RFC 9116, our active /.well-known/security.txt file is served on this domain:
Contact: mailto:[email protected] Contact: https://github.com/s1rbl4ck/portfolio-client/security/advisories/new Preferred-Languages: en, it Canonical: https://s1rbl4ck.com/.well-known/security.txt Expires: 2027-08-07T00:00:00.000Z
Need a custom vendor security questionnaire (VSQ, CAIQ, SIG Lite) completed?
Email [email protected]