Security & Compliance

SOC 2: our controls are designed to align with the SOC 2 Trust Services Criteria, and we are actively working toward formal SOC 2 attestation with continuous compliance monitoring.

HIPAA-grade safeguards: although animal wellness data is not Protected Health Information under HIPAA, we voluntarily apply comparable administrative and technical safeguards — access controls, audit logging, encryption in transit, and least-privilege design.

PCI DSS: all card payments are processed by Stripe, a certified PCI DSS Level 1 service provider. Card numbers never touch Soula Paws servers.

GDPR / CCPA: we support data-subject rights (access, export, deletion) directly in-app via Privacy & Consent.

Encryption in transit: all traffic is served over TLS (HTTPS) with HSTS enforced.

Authentication: passwords hashed with bcrypt; short-lived signed JWT sessions; account lockout after repeated failed sign-in attempts (brute-force protection).

Authorization: strict role-based access control (owner / caregiver / admin) enforced server-side on every request; users can only access their own records.

Rate limiting: layered per-endpoint and global per-IP rate limits protect against abuse and denial-of-service attempts.

Bot protection: invisible proof-of-work challenges on signup and password-reset stop automated abuse with zero user friction — no puzzles, no tracking, no third-party service.

Hardened HTTP headers: Content-Security-Policy, X-Frame-Options (clickjacking protection), X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy.

Upload safety: file type allow-listing and per-file size limits on all attachments.

Every sensitive action (sign-in, data changes, AI calls, billing events, admin actions) is written to an immutable audit log.

Deleted records are soft-deleted with full traceability before purge, preventing accidental data loss.

Payment amounts and plan entitlements are resolved server-side only — the client can never set its own price or plan.

AI guardrails: every AI feature is bounded by non-negotiable safety rules — no diagnosis, no prescriptions, mandatory escalation language for urgent signals, and stated confidence levels.

We welcome good-faith security research. If you believe you've found a vulnerability, email luminasoula@gmail.com with the subject "SECURITY" and we will acknowledge within 48 hours. Please do not access other users' data or degrade the service while testing.

We maintain an incident response process covering triage, containment, remediation, and user notification. If an incident affects your personal data, we will notify you without undue delay, consistent with applicable law.