How we keep your data + reputation safe.
We run customer UGC for regulated industries. The bar is high. The story below is what is true today, not the marketing version. Where something is on the roadmap, we say so.
30 d
daily backups · retention
eu-west-2
AWS · single region
90 d
audit retention · 1 y on request
< 72 h
breach notification
Security researcher? Report a vulnerability. We don’t run a paid bug bounty.
Example event counter · not live data
284,173
UGC posts · rights requests · widget impressions
AWS eu-west-2
London · single-region
Daily
30-day retention
Event tail · last 4
- TLS 1.3 ✓inbound · widget.js0s
- AES-256 ✓tenant 0x7a2 · put0.4s
- RBAC ✓rights.read · ok1.1s
- Audit ✓login · google1.6s
Posture · today
- Live
Encryption
TLS 1.3 · AES-256
- Live
Roles + sign-in
RBAC · email or Google
- Live
Audit log
90 d · 1 y on req
- Roadmap
Pen test
Not yet engaged
- Roadmap
SOC 2
In audit
- Roadmap
ISO 27001 / PCI
2026 roadmap
Request rate · per s
The full posture
Six surfaces, every line annotated as live, in progress or on the roadmap. The DPA goes deeper on each row and is the procurement-ready version of this page.
Compliance posture
- Roadmap
SOC 2
In audit · not certified yet
- Live
GDPR / UK GDPR
Self-certified · DPA available
- Live
CCPA · CPRA
Self-attested · DSAR workflow
- Live
India DPDP
Self-attested · data fiduciary
- Roadmap
ISO 27001
On the roadmap, not yet started
- Roadmap
PCI DSS
On the roadmap · we do not store PAN
Access + identity
- Live
TLS 1.3
Inbound + outbound · HSTS
- Live
AES-256 at rest
Database + object storage
- Live
Sign-in
Email + password or Google sign-in
- Roadmap
SAML SSO · SCIM
Not available yet
- Live
Role-based access
Owner / Admin / Editor / Viewer
- In prog
MFA
Enforced for internal systems today; company-wide rollout planned
Infrastructure
- Live
Region
AWS eu-west-2 · London
- Live
Edge + CDN
Vercel · Cloudflare
- Live
Secrets management
AWS Secrets Manager · KMS rotated
- Live
Backups
Daily snapshots · 30-day retention
- Roadmap
Multi-region failover
Roadmap · 2027
Data + retention
- Live
Tenant isolation
Per-tenant ID, row-level scoping
- Live
Audit log retention
90 days standard · 1 year on customer request
- Live
GDPR deletion SLA
30 days · documented in DPA
- Live
Sub-processors
Public list · email-notified change
- Live
Data export
Self-serve · JSON + CSV
Monitoring + assurance
- Live
Application monitoring
Sentry · OpenTelemetry · 24/7
- Live
Anomaly alerting
Auth + billing + rate-limit
- Roadmap
Penetration testing
Not yet engaged · planned as part of SOC 2 readiness
- Live
Vulnerability reports
security@idukki.io · no paid bounty
- Live
On-call ack
< 15 min business / 30 min nights
Incident response
- Live
Public status page
status.idukki.io · uptime + incidents
- Live
Customer notification
72 hours of confirmed disclosure
- Live
DPA breach clauses
Contractually committed timelines
- Roadmap
DR drills
Not yet run · planned
Vulnerability disclosure
Found a security hole? Tell us first.
Email security@idukki.io. A report with these four things gets fixed fastest:
- Steps to reproduce
- The affected URL or endpoint
- What an attacker could do with it (impact)
- Screenshots or a proof of concept
What happens next
3
business days
Acknowledgement
A person replies to confirm we have your report and are looking at it.
10
business days
Status update
Whether we could reproduce it, how serious we think it is, and what happens next.
Fix
live
We tell you
You hear from us when the fix is deployed, so you know when coordinated disclosure can start.
No bug bounty. No HackerOne.
Idukki does not run a paid bug bounty, and we don’t have a HackerOne or Bugcrowd programme. So we don’t pay for reports, and there are no programme invites to hand out.
We are genuinely grateful for good-faith reports. Once a fix is live, we’re happy to credit you by name on this page if you’d like that.
In scope
- idukki.ioMarketing site
- app.idukki.ioMerchant dashboard
- api.idukki.ioAPI
- widget-api.idukki.ioWidget data API
- Idukki Shopify appapps.shopify.com listing
Out of scope
- Third-party services we use or link to
- Social engineering of staff or customers
- Physical attacks on offices or equipment
- Denial-of-service or volumetric testing
- Automated scanner output without a demonstrated impact
- Missing best-practice headers with no working exploit
- SPF / DMARC findings, or clickjacking on pages with no sensitive action
- Rate-limit or brute-force reports without impact
Rules of engagement
- Use your own test accounts only.
- Don’t access, modify or delete other customers’ data.
- If you find access to data that isn’t yours, stop there and report it.
- No testing that degrades the service for anyone else.
- Give us reasonable time to fix before any public disclosure: 90 days, or when the fix is live, whichever is sooner, unless we agree otherwise.
Safe harbour
If you research in good faith and follow these rules, we treat your work as authorised and won’t take legal action against you over it.
Need the DPA, sub-processor list and security questionnaire?
We ship a single ZIP. DPA (with SCCs), sub-processor register, and a redline-friendly MSA. Request it once, route it through legal.
- DPA + SCCs
- Sub-processor register
- MSA redlines
One-click bundle
Request the DPA bundle
Sent within one UK business day. No sales call required.
Security review
Need our security pack or DPA?
Available under NDA in minutes: DPA, SIG-Lite + CAIQ pre-filled and the SOC 2 audit progress note.
- No credit card
- Cancel anytime
- GDPR self-certified · SOC 2 (in audit)
