Security & Trust
Security is a default, not a deliverable
Every Sufyaan Studio site ships secure by default: TLS 1.3, HSTS, CSP, OWASP Top 10 mitigation, dependency scanning, and a documented vulnerability disclosure program.
- 100%
- HTTPS-only
- 0
- Known breaches
- 24h
- Disclosure SLA
- OWASP
- Top 10 aligned
Security practices
What we ship, by default, on every engagement.
Encryption at rest & in transit
TLS 1.3+ on every endpoint. AES-256 encryption for stored data. Customer-managed keys available on enterprise engagements.
Authentication & authorization
OAuth 2.1, OIDC, SAML SSO. Role-based access control (RBAC) with least-privilege defaults. MFA enforced for all internal systems.
Vulnerability management
Continuous dependency scanning (Snyk, GitHub Dependabot, npm audit). Weekly patch cadence. Critical CVEs patched within 24 hours of disclosure.
Infrastructure & hosting
Vercel, AWS, and Cloudflare with private networking, WAF rules, rate limiting, and DDoS protection on every project by default.
Logging, monitoring & incident response
Centralized logging with structured events. 24/7 uptime monitoring. Documented incident response runbook. PagerDuty for retainer clients.
Compliance posture
GDPR-aware by default. HIPAA-aware for healthcare engagements. PCI DSS inherited from Stripe. SOC 2 Type II roadmap for Q4 2026.
Compliance frameworks
We meet or inherit the major frameworks our clients operate under.
GDPR
CompliantEU General Data Protection Regulation. DPA available on request.
CCPA / CPRA
CompliantCalifornia Consumer Privacy Act / California Privacy Rights Act.
HIPAA
AwareHealth Insurance Portability and Accountability Act. BAAs available for healthcare engagements.
PCI DSS
InheritedInherited from Stripe for all payment-processing engagements.
SOC 2 Type II
Roadmap Q4 2026Currently in audit preparation. Type I report available on request under NDA.
ISO 27001
Roadmap 2027Information security management system certification in progress.
Vulnerability disclosure policy
We welcome good-faith security research. If you've found a vulnerability, please report it to us first.
Do not exploit a vulnerability beyond the minimum necessary to demonstrate it. Do not access, modify, retain, transfer, or destroy data that is not your own. Do not degrade our services.
security@sufyaan.studio
dev.sufyaan@gmail.com (subject: SECURITY)
PGP: 0xDEADBEEF (placeholder)
We acknowledge reports within 24 hours, triage within 72 hours, and credit researchers in our public hall of fame (on request) after the issue is fixed.
Default Content Security Policy
Every site we ship includes a hardened Content Security Policy. Here's the baseline:
Content-Security-Policy:
default-src 'self';
script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.googletagmanager.com https://*.google-analytics.com https://vercel.live;
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
img-src 'self' data: blob: https: http:;
font-src 'self' data: https://fonts.gstatic.com;
connect-src 'self' https://*.sufyaan-studio.com https://*.vercel.app wss://*.vercel.app https://*.google-analytics.com https://*.analytics.google.com https://formsubmit.co;
frame-ancestors 'none';
base-uri 'self';
form-action 'self' https://formsubmit.co mailto:;
object-src 'none';
upgrade-insecure-requests;Security FAQ
Common questions from security and compliance teams.
How do I report a security vulnerability in a Sufyaan Studio site?
Email security@sufyaan.studio (or dev.sufyaan@gmail.com with subject: SECURITY). Please include a description, reproduction steps, and any proof-of-concept code. We respond within 24 hours and credit researchers on request after the issue is fixed. We do not pursue legal action against good-faith security research.
What is your security patch SLA?
Critical CVEs (CVSS 9.0+) are patched within 24 hours of disclosure. High-severity (CVSS 7.0-8.9) within 7 days. Medium (4.0-6.9) within 30 days. Low (<4.0) within the next release cycle. We notify retainer clients of any patch affecting them in real time.
Do you sign NDAs and BAAs?
Yes. Mutual NDAs are available before scoping. Business Associate Agreements (BAAs) for HIPAA-covered engagements. Data Processing Agreements (DPAs) for GDPR-covered engagements. We will sign your custom paper on request.
Where is client data stored?
Data is stored in the regions chosen by the client. Default is US-East (AWS us-east-1) or Vercel's edge network. EU, UK, AU, and APAC options are available. Data residency is contractually guaranteed for regulated industries.
Do you do penetration testing?
We coordinate third-party penetration tests for enterprise clients and have trusted partners who perform web app, API, and infrastructure tests. We remediate findings with our standard SLA. Reports are shared with the client under NDA.
What happens to data when an engagement ends?
Client data is exported in full at the end of the engagement (within 30 days). Source code, design files, credentials, and documentation are transferred to the client. We retain a backup for 90 days for recovery purposes, then permanently delete. Deletion is certified in writing.
Sufyaan Studio — Security & Trust
Sufyaan Studio ships secure by default. Every engagement includes TLS 1.3, HSTS, a hardened Content Security Policy, OWASP Top 10 mitigations, continuous dependency scanning, and a documented vulnerability disclosure program. We are GDPR and CCPA compliant, HIPAA-aware, and inherit PCI DSS from Stripe for payment-processing projects. SOC 2 Type II is on the roadmap for Q4 2026; ISO 27001 for 2027. The studio responds to vulnerability reports within 24 hours and to critical CVE patches within 24 hours. Security contact: security@sufyaan.studio. Founded 2020. 200+ projects shipped. 50+ countries served.