Data Protection
Encryption in Transit
All data is transmitted using TLS 1.3. HTTP requests are automatically redirected to HTTPS.
Encryption at Rest
Passwords stored as bcrypt hashes. Sensitive data (messages, psychometrics) encrypted with AES-256.
Key Management
Cryptographic keys managed via Google Cloud KMS with rotation every 90 days.
Backups
Daily encrypted backups stored across multiple geographic regions.
Account Security
Email Verification
We send a confirmation link when you register. Invitations and anything granted by email work only from a confirmed address.
Auto Sign-Out
A session lasts 5 days. Signing out and changing your password end every session on every device.
Brute Force Protection
Rate limiting on all API endpoints. Temporary lockout after multiple failed login attempts.
Infrastructure
GDPR Compliance
- Full GDPR compliance (EU Regulation 2016/679)
- Appointed Data Protection Officer (DPO)
- Records of Processing Activities (ROPA)
- Data Protection Impact Assessments (DPIA) for high-risk operations
- Standard Contractual Clauses (SCC) for international data transfers
- Breach notification within 72 hours (Art. 33 GDPR)
Responsible Vulnerability Disclosure
If you discover a security vulnerability, we welcome responsible disclosure:
Email: security@avatarmatch.app
Please include:
- Vulnerability description and potential impact
- Steps to reproduce
- Your contact information (optional)
We respond within 5 business days and fix critical vulnerabilities within 30 days.
Please: Do not publicly disclose the vulnerability before it is fixed.
Account Security Tips
- Use a unique email not shared with other platforms
- Confirm your email — invitations to an organization need it
- If you suspect someone else signed in, change your password — it ends every session
- Report suspicious activity immediately: security@avatarmatch.app