01. Security Architecture Philosophy
At SubsFolio, security is designed into every layer of our software lifecycle. We operate under a Zero-Trust framework where data access is authenticated, authorized, and logged at every transaction.
Our platform architecture ensures strict tenant separation, meaning your team's subscription spend, vendor costs, contracts, and payment dates are completely isolated from all other organizations.
02. Encryption Protocols
We apply modern cryptography across data states:
- In Transit: All HTTP traffic is forced over HTTPS using Transport Layer Security (TLS 1.3 / TLS 1.2 with HSTS enforced). Cipher suites are strictly modern to prevent downgrade attacks.
- At Rest: All database volumes, backups, and attachments are encrypted using AES-256 encryption.
- Credential Hashing: User passwords are never stored in plain text. We utilize salted, high-work-factor cryptographic hash algorithms (bcrypt / Argon2) that resist GPU brute-force cracking.
03. Payment Security & PCI-DSS Compliance
SubsFolio takes financial confidentiality seriously. We do not store, process, or transmit raw credit card numbers on our infrastructure:
04. Multi-Tenant Isolation & Role-Based Access (RBAC)
To prevent horizontal privilege escalation and data leakage between organizations and workspace members, SubsFolio implements strict server-side validation:
- Admin Role: Complete workspace management, billing control, member invitations, and subscription additions/modifications.
- Member Role: Create and update subscriptions, view analytics, and manage renewal alerts.
- Viewer Role: Read-only access to spend reports and dashboards without ability to modify financial data or team settings.
05. Renewal Alert Engine & Cron Security
Our automated renewal reminder engine processes upcoming payment notifications securely:
- Cryptographic Token Protection: Automated background workers and cron triggers require secure, randomized authorization tokens to execute, preventing unauthenticated webhook calls.
- Rate Limiting: Endpoints are protected against denial-of-service and brute-force hammering by strict IP and rate limiting policies.
06. Backups & Disaster Recovery
To prevent data loss and ensure high reliability:
- Automated Snapshots: Encrypted database snapshots are captured daily and stored in geo-redundant storage regions.
- Recovery Point Objective (RPO): Our target RPO is under 24 hours in the event of an unforeseen catastrophic infrastructure failure.
- Recovery Time Objective (RTO): Target RTO is under 2 hours with automated provisioning scripts.
07. Cloud Infrastructure & DDoS Protection
SubsFolio is hosted in ISO 27001, SOC 2 Type II, and PCI-DSS certified cloud data centers.
- Cloudflare Edge Protection: Public DNS and HTTP traffic pass through Cloudflare's global edge network, providing automatic DDoS mitigation, Web Application Firewall (WAF) filtering, and SSL termination.
- Sanitization & SQL Injection Defense: All database queries utilize parameterized prepared statements (`PDO::prepare`) to completely eliminate SQL injection vectors.
08. Vulnerability Reporting & Responsible Disclosure
We appreciate the contributions of independent security researchers. If you identify a potential security vulnerability in our platform, please disclose it to us responsibly:
Email: contact@subsfolio.com
Please include a detailed description of the finding, reproduction steps, and proof-of-concept. We commit to acknowledging receipt within 24 hours and working swiftly to remediate confirmed issues.