Security

• Application hosted on enterprise-grade cloud infrastructure with regional redundancy.
• MongoDB Atlas primary datastore, encrypted at rest (AES-256) and in transit (TLS 1.2+).
• All traffic served over HTTPS via modern TLS with HSTS enabled.

• Passwords hashed with bcrypt.
• Short-lived JWT access tokens (15 min) paired with refresh tokens (7 days) stored in HTTP-only, Secure, SameSite=Lax cookies.
• Role-based access control (Super Admin, Admin, Beta Founder, Customer, Enterprise) enforced server-side on every route.
• Payment access enforced only after verified Stripe webhook events — never on a browser redirect alone.

All payments are processed by Stripe, a PCI-DSS Level 1 service provider. Founder OS™ never receives, stores, or transmits full card numbers or CVCs. We store only Stripe customer IDs, subscription statuses, and receipt metadata.

Every privileged administrative action (role changes, beta grants, promotional access, account suspension, session revocation) is recorded to an append-only audit_logs collection with actor identity, affected user, previous/new values, reason, IP address, and user agent. Audit records are never mutated after insertion.

AI recommendations are generated on-demand using Anthropic’s Claude Sonnet 4.5 API. We never fine-tune third-party models on your data. AI outputs are advisory only (see Terms § 5).

Databases are backed up continuously with point-in-time recovery. RPO < 5 minutes; RTO < 1 hour for a full restore. Backups are encrypted with the same standards as production data.

If we detect or receive a report of a security incident affecting user data, we will:

1. Contain the incident within 24 hours of confirmation.
2. Notify affected users without undue delay, and in any event within the timeline required by applicable law (72 hours under GDPR).
3. Publish a post-mortem summarising root cause and remediation.

We appreciate responsible disclosure. Email support@stabilitylogic.com with subject “Security disclosure” and we will acknowledge within 24 hours. Please do not publicly disclose the issue before we have had a reasonable opportunity to remediate.

Founder OS™ is currently pre-SOC2. We follow the CIS Controls v8 essentials and are building toward SOC 2 Type II readiness in 2026. For enterprise procurement, contact support@stabilitylogic.com to request our current security questionnaire responses.