PingRoam

安全政策

Security Policy

Last updated: July 11, 2026

1. Overview

PingRoam is committed to protecting your data through industry-standard security practices. This policy describes the technical and organizational measures we use to safeguard information processed through our website, API, and mobile application.

2. Encryption

  • In transit: All connections use TLS 1.2+ (HTTPS).
  • At rest: Database credentials and secrets are stored in secure environment variables. Payment card data is never stored on PingRoam servers — Paddle and NOWPayments handle payment data directly.
  • Authentication: Firebase Auth issues short-lived ID tokens verified on every API request.

3. Access Controls

  • Production database access is restricted to authorized personnel.
  • Admin panel access is limited to whitelisted administrator email addresses.
  • API routes enforce authentication and ownership checks (IDOR protection) on user data, support tickets, and privacy requests.

4. Infrastructure Security

  • API rate limiting (100 requests/minute per IP).
  • Webhook signature verification for Paddle, NOWPayments, and Triposim.
  • Structured error logging without exposing sensitive data in client responses.

5. Mobile Application Security

  • Auth tokens are managed by Firebase SDK; sensitive tokens are not stored in AsyncStorage.
  • Push notification tokens (FCM) are stored server-side and deleted when you disable notifications or delete your account.

6. Incident Response

We maintain an internal incident response procedure. If we identify a security incident affecting personal data, we will:

  1. Contain and investigate the incident promptly.
  2. Notify affected users and relevant supervisory authorities within 72 hours where required by GDPR.
  3. Document remediation steps and update controls as needed.

7. Vulnerability Reporting

If you discover a security vulnerability, please report it responsibly to privacy@pingroam.com with the subject line Security Report. Do not publicly disclose vulnerabilities before we have had a reasonable opportunity to address them.

8. Contact

For security-related inquiries: privacy@pingroam.com