Security & Data Processing Agreement

At Impry OS, safeguarding freelancer revenue and client data is our highest engineering priority. Our infrastructure is architected around the principles of Defense-in-Depth, Least Privilege, and Zero Trust.

We operate on modern serverless and managed database architectures provided by audited cloud providers with SOC 2 Type II, ISO 27001, and HIPAA-compliant facilities.

We enforce modern cryptographic standards across the entire application lifecycle:

• Encryption in Transit: All HTTP requests are strictly routed over HTTPS using TLS 1.3 with HSTS (HTTP Strict Transport Security) enabled. Insecure HTTP connections are automatically terminated.
• Encryption at Rest: PostgreSQL database disks, automated snapshots, and object storage volumes are encrypted using industry-standard AES-256 with managed KMS keys.
• Credential Hashing: User passwords are never stored in plaintext. Passwords are salted and hashed using compute-hard algorithms (Argon2id and Bcrypt) through Better Auth.
• Payment Tokenization: Credit card numbers are tokenized directly with PCI-DSS Level 1 certified processors (Paddle / Stripe). Impry OS never receives or stores raw cardholder data.

Impry OS utilizes strict logical multi-tenancy. Every request is verified through a multi-tier authorization gate:

• Server Middleware & withAuth Guard: Incoming Server Actions evaluate the user's session token and verify workspace membership (verifyWorkspaceAccess) before executing any business logic.
• Scoped Database Queries: All database operations are explicitly scoped by workspace_id and user_id.
• Role-Based Access Control (RBAC): Granular permissions enforce distinctions between Workspace Owners, Admins, and Members.

4.1 Dependency & Code Auditing: Our CI/CD pipelines run continuous static analysis (SAST) and automated vulnerability auditing against all third-party npm packages.

4.2 Incident Response & Notification: In the unlikely event of a security incident impacting customer data, Impry OS will notify affected account holders within seventy-two (72) hours of confirmation, in compliance with GDPR Article 33.

4.3 Backups & Disaster Recovery: Automated rolling PostgreSQL database backups are taken continuously with point-in-time recovery (PITR) enabled across geo-redundant storage regions.

This Section constitutes the Data Processing Agreement ("DPA") between you (the "Data Controller") and Impry OS (the "Data Processor") regarding personal data processed through your use of the Service.

5.1 Scope & Purpose: The Data Processor shall process Personal Data solely on documented instructions from the Data Controller and exclusively for providing the Service.

5.2 Confidentiality: All personnel authorized to process personal data are bound by strict contractual confidentiality obligations.

5.3 Sub-Processors: The Data Controller provides general authorization for Impry OS to engage sub-processors (e.g., PostgreSQL hosting, Resend email dispatch, Vercel infrastructure) subject to equivalent data protection standards.

5.4 Assistance & Audits: Impry OS shall assist the Data Controller in fulfilling data subject access requests and provide necessary compliance certifications upon reasonable request.

We welcome reports from security researchers. If you believe you have discovered a security vulnerability in Impry OS, please report it responsibly to security@impryos.com with detailed reproduction steps.

We commit to acknowledging all security disclosures within twenty-four (24) hours and will not pursue legal action against researchers acting in good faith under responsible disclosure guidelines.