Security Policy

Effective 2026-10-14 · Last updated 2026-09-13

1. Our Commitment

Security is foundational to Fratelli. Your business runs on the data you keep with us, and we treat protecting it as a core product responsibility. This page describes the controls we operate today.

2. Infrastructure

• Hosted on Google Cloud Platform / Firebase, which maintains SOC 1/2/3, ISO 27001/27017/27018, and PCI DSS certifications for its infrastructure.
• AES-256 encryption at rest; TLS 1.2+ for all data in transit; HSTS and a strict Content Security Policy on our web apps.
• Continuous, point-in-time and geo-redundant backups; tested restore procedures.
• Google's DDoS protection and edge network; Firebase App Check to reject requests from unauthorized clients.

3. Authentication and Access Control

• Multi-factor authentication (TOTP) and passkeys / WebAuthn, including Face ID, Touch ID, and Windows Hello.
• New-device verification with email codes and trusted-device management; login risk scoring based on device and location.
• Session management: view and revoke active sessions, automatic idle lock, forced sign-out on password change.
• Role-based access control with granular permissions for team members; the account owner controls all access.
• Rate limiting and lockouts on authentication and recovery endpoints; recovery codes for account recovery.

4. Data Protection and Tenant Isolation

• Every read and write is authorized by database security rules that enforce per-business isolation server-side — not just in the app.
• Sensitive identifiers (e.g., tax IDs in payroll) are stored with last-four-only display; payment card and bank details are held exclusively by Stripe and Plaid.
• Encrypted, customer-controlled backups and full export in standard formats; account deletion with a 30-day recovery hold.

5. Staff Access to Customer Accounts

We believe you should know exactly how our own team can touch your account.

Authorized Fratelli Platform Inc. personnel may access your account and Customer Data only for the following purposes: (a) responding to a support request you or your team initiated; (b) investigating suspected fraud, abuse, security incidents, or violations of these Terms; (c) diagnosing and resolving technical problems; (d) complying with law, legal process, or a Stripe, card-network, or banking-partner requirement; and (e) protecting the rights, property, or safety of Fratelli Platform Inc., our customers, or the public.

Support access is governed by strict controls:

• Read-only. Support "view as customer" sessions cannot create, modify, delete, send, or charge anything. Changes to your account are only made by you, or by Fratelli Platform Inc. through separately logged administrative actions (for example, applying a refund you requested or suspending an account for abuse).
• Time-limited and re-authenticated. Each session expires automatically after 15 minutes and requires the staff member to re-verify their identity immediately beforehand.
• Documented reason. A written reason is required for every session and every administrative action.
• Fully logged. The staff member's identity, timestamp, reason, and actions are recorded in a tamper-evident audit trail retained for at least 24 months.
• Visible to you. A record of each support access appears in your account's Security & Activity timeline.
• No card or bank secrets. Staff never see full payment card numbers, bank account numbers, passwords, or identity documents. Those are held by Stripe, Plaid, or Google and are only ever displayed in masked form (for example, the last four digits).

Administrative actions that change an account (for example, adjusting a plan limit at your request, issuing a refund, or suspending an account for abuse) are performed through dedicated, server-side tools — never by editing the database directly — and each one requires a written reason and is written to the same audit trail. Staff cannot disable this logging.

6. Payments Security

Payments are processed by Stripe, a PCI DSS Level 1 service provider. Card data is entered into Stripe-hosted fields and never transits Fratelli's servers. We monitor dispute rates, payment-link abuse signals, and Stripe risk indicators and may pause payment acceptance to protect you and your customers.

7. Monitoring, Logging, and Incident Response

• Real-time security event logging: sign-ins, new devices, failed attempts, MFA changes, password resets, session revocations, and staff access — visible to you in Settings → Security.
• Automated anomaly detection for login patterns, unusual AI or email volume, and error spikes.
• Defined incident response and escalation procedures. If an incident affects your data we notify you without undue delay and within 72 hours where required by law, with what happened, what data was involved, and what we are doing.

8. Secure Development

• Code review for all changes; automated type-checking, tests, and security-rule tests before deployment.
• Dependency monitoring with a minimum-release-age policy to reduce supply-chain risk.
• Secrets stored in Google Secret Manager; least-privilege service accounts.
• Regular security reviews; third-party penetration testing.

9. Compliance

• GDPR / UK GDPR: Data Processing Addendum with Standard Contractual Clauses; data-subject request tooling; 72-hour breach notification.
• CCPA/CPRA: service-provider terms; no sale or sharing of personal information.
• CAN-SPAM / TCPA: preference center and one-click unsubscribe on all marketing email.
• Google API Services User Data Policy (Limited Use) for Gmail integration.

10. Responsible Disclosure

If you discover a vulnerability, please email security@fratelli-app.com with details and steps to reproduce. We will acknowledge within 2 business days, keep you informed, and will not pursue legal action against good-faith research that avoids privacy violations, data destruction, and service disruption.

11. Contact

Security questions: security@fratelli-app.com. Privacy questions: privacy@fratelli-app.com.