Security Policy

We are committed to maintaining the security, confidentiality, and integrity of the personal data and creative content entrusted to us. We implement industry-standard security practices appropriate to the nature and sensitivity of the data we process.

We employ the following security measures:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.3 (HTTPS)
• Password security: User passwords are hashed using bcrypt with 12 salt rounds — we never store plain-text passwords
• Authentication: JWT-based token authentication with 7-day expiration, role-based access controls
• Payment security: All payment processing is handled by Stripe, which is PCI-DSS Level 1 certified. We never store full credit card numbers
• Database security: MongoDB Atlas cloud database with encrypted connections, automated backups, and access controls
• Image storage: Cloudinary CDN with secure upload endpoints and access-controlled media delivery
• Email verification: Required for account activation to prevent unauthorized account creation

All user data is isolated by user ID — you can only access your own artworks, clusters, and account data. API endpoints verify ownership on every request. Admin access is restricted to authorized personnel with role-based controls.

In the event of a security incident or data breach, we will: contain and assess the breach immediately, notify the Spanish Data Protection Authority (AEPD) within 72 hours as required by GDPR Article 33, notify affected users without undue delay if the breach poses a high risk to their rights (GDPR Article 34), and take corrective action to prevent recurrence.

If you discover a security vulnerability in our Service, please report it responsibly to: security@pablito.app. Please include a description of the vulnerability and steps to reproduce it. We will acknowledge receipt within 48 hours and work to address confirmed vulnerabilities promptly. We ask that you do not publicly disclose vulnerabilities until we have had a reasonable opportunity to address them.

For security-related inquiries: security@pablito.app For data protection inquiries: privacy@pablito.app