Information Security

This page describes how PressWiser protects the platform. It lists measures we can point to in the product and its build process; where a measure depends on how and where it is hosted, it is stated as an operating fact below. We do not hold, and do not claim, any security certification.

1. In the application

• Passwords are stored only as salted one-way hashes. Password resets use an emailed, expiring link.
• Sign-in, password reset and sign-up are rate-limited to slow guessing and abuse.
• Sessions use signed, HTTP-only cookies. Suspending an organization takes effect on its next request, even mid-session.
• Tenant isolation: every organization's data is read through its own scope, not by remembering a filter per screen. An advertiser cannot read another advertiser's orders, and a publisher cannot read another publisher's submissions or messages. This is covered by automated tests.
• Roles: advertiser, publisher and administrator areas are separate, and administrators cannot take editorial decisions on a publisher's behalf.
• Money is a ledger. Credit balances are always the sum of an append-only history, so every balance can be reconstructed and audited.
• Payments: card details are entered only on Stripe-hosted pages. Stripe's notifications to us are accepted only if their signature verifies, and each is processed once.
• Uploads are limited by file type and size. Message attachments are served as downloads, and message text is escaped.

2. In how we build

• Every change runs through automated tests, a static security scanner for Rails code (Brakeman), a dependency vulnerability audit (bundler-audit) and an audit of JavaScript dependencies before release.
• Secrets are kept in encrypted credentials or environment configuration, not in the source repository.

3. Operating environment

• Transport security: TLS terminated at the host's reverse proxy, with HTTP redirected.
• Encryption at rest: AES-GCM-256.
• Backups: daily, weekly, monthly.
• Hosting: Amazon Web Services (AWS).

4. Your part

Use a strong, unique password, keep it private, remove colleagues who leave, and tell us promptly if you think an account has been compromised.

5. Reporting a vulnerability

If you believe you have found a security problem, email security@presswiser.com with enough detail to reproduce it. Please do not access data that is not yours, degrade the service, or disclose the issue publicly until we have had a reasonable chance to fix it. We will acknowledge your report, keep you informed, and will not take action against good-faith research that follows these rules.

6. Incidents

If a security incident affects your data, we will notify affected account owners and the relevant authorities as the law requires. See also our Privacy Policy.