Security

How we protect your company's data

The practices below are what the platform does today; each one is part of the code and covered by automated tests.

Separation between companies

  • Every record belongs to one company. A panel user only sees the company they are a member of; an API key only ever reaches its own company's data.
  • Requests for another company's records return "not found"; this is checked by automated tests on every build.

Connections and sign-in

  • All traffic is encrypted (HTTPS). Browsers are told to use only secure connections (HSTS, preload); API and MCP requests over plain HTTP are rejected, not redirected.
  • Two-step verification and passkeys are supported for panel accounts; platform administrators must use two-step verification.
  • Sign-in, registration and similar forms are rate-limited and protected against automated submissions.

API and AI assistant access

  • API keys are 256-bit random values. We store only their hash; the key is shown once when it is created.
  • Each key works only with the scopes you choose, can have an expiry date, can be revoked instantly and shows its last use in the panel.
  • Rate limits apply per key (120 requests per minute) and per IP address; request bodies are limited in size. Failed authentication attempts are written to the security log (never the key itself).
  • Panel sessions are ignored on the API: a signed-in browser cannot call the API without a key.
  • Text written by visitors (card-page leads) is labelled for AI assistants as data, not instructions.

Audit log

  • Changes to cards and keys are recorded with who, when and through which channel (panel, API or MCP). Previous versions of a card can be restored in the panel.

Credentials and personal data

  • Passwords and tokens you enter for your own connections (CRM, SMS, email, AI provider) are stored encrypted and masked on screen. Your AI key is used only for the features you run, never replaced by a platform key.
  • Personal data is processed as described in our privacy notice. Privacy notice (KVKK) · Privacy

Development

  • Every release is built and tested automatically before it goes live; a release does not ship when a test fails.
  • Every build checks our software packages against known security vulnerabilities; a known vulnerability stops the build.

Reporting a vulnerability

If you find a security issue, write to us at support@digicardsystem.com. Please give us time to fix it before making it public. Machine-readable contact: /.well-known/security.txt

Integration guide Developers