Security Practices

Last updated: June 17, 2026

Overview

Security is foundational to Invisible. We design our systems with the principle of least privilege and defense in depth. This page describes the technical and organizational measures we take to protect your data.

Encryption

Data at Rest

  • All database volumes use AES-256 encryption
  • OAuth tokens and credentials are encrypted with a separate key
  • File storage (media attachments) uses server-side encryption
  • Encryption keys are managed via a dedicated secrets management system

Data in Transit

  • All client-server communication uses TLS 1.3
  • All internal service-to-service communication is encrypted
  • API calls to third-party platforms use HTTPS exclusively
  • HSTS is enforced on all endpoints

Infrastructure Security

  • Infrastructure runs on Kubernetes with network policies restricting pod-to-pod communication
  • All services run in private networks; only necessary endpoints are exposed via secure ingress
  • Container images are scanned for vulnerabilities on every build
  • Infrastructure-as-code with version-controlled configuration
  • Regular updates and patching of all dependencies and base images
  • Secrets managed through dedicated secret management (not environment variables or config files)

Access Controls

  • Role-based access control (RBAC) for all internal systems
  • Principle of least privilege for all service accounts
  • Multi-factor authentication required for all administrative access
  • Audit logging for all access to production systems
  • No employee has standing access to user message data
  • Access to user data requires explicit approval and is time-limited

Authentication

  • Passwords are hashed using bcrypt with cost factor 12
  • OAuth 2.0 for all third-party platform connections — we never store platform passwords
  • Session tokens are short-lived with refresh rotation
  • Failed login rate limiting and account lockout policies
  • Cross-origin request protection (CORS, CSRF tokens)

Data Isolation

  • Each user's data is logically isolated in the database with row-level security
  • Multi-tenant architecture with strict query-level isolation
  • No cross-user data access possible through the application layer
  • Automated testing for data isolation in CI/CD pipeline

Monitoring and Incident Response

  • 24/7 monitoring of all production systems
  • Automated alerting for anomalous access patterns
  • Centralized logging with tamper-evident audit trails
  • Incident response plan with defined escalation procedures
  • Breach notification within 72 hours as required by GDPR
  • Post-incident reviews and process improvements

Vulnerability Management

  • Regular vulnerability scanning of all infrastructure and dependencies
  • Automated dependency updates via CI/CD pipeline
  • Security-focused code reviews for all changes
  • Annual third-party security assessment (for restricted scope APIs)

If you discover a security vulnerability, please report it responsibly to [email protected]. We acknowledge all reports within 24 hours.

Data Processing Principles

  • Purpose limitation: Data is processed only for the purposes described in our Privacy Policy
  • Data minimization: We only collect data necessary to provide the Service
  • Storage limitation: Data is retained only as long as needed or required by law
  • No secondary use: User data is never used for advertising, profiling, or sold to third parties
  • Human access: Employees may only access user data with explicit approval for support or security purposes, and only the minimum necessary

Compliance

We comply with applicable regulations including:

  • GDPR (General Data Protection Regulation) for EEA users
  • CCPA (California Consumer Privacy Act) for California residents
  • COPPA (Children's Online Privacy Protection Act) — we do not serve users under 13
  • Meta Platform Terms for Instagram/Messenger data processing
  • Google API Services User Data Policy for Gmail/Google data processing

Contact

Security-related inquiries and vulnerability reports:

Invisible