Security & Trust
The concrete technical and organizational measures we use to protect your Account and data.
Executive Summary
This Security Center describes, concretely, the technical and organizational measures WE ARE TOGETHER uses to protect your Account and data. We would rather describe our real controls plainly than lean on a badge or certification we haven't earned — an institutional investor's technical diligence team can verify every claim on this page.
1. Purpose
This page supplements our Privacy Policy by describing, in concrete terms, how we protect the confidentiality, integrity, and availability of Platform data.
2. Account Security
Passwords are never stored in plain text — we store only a salted cryptographic hash (bcrypt), so even in the event of unauthorized database access, your actual password is not exposed. Session tokens are stored as HttpOnly cookies, inaccessible to page scripts, and are themselves hashed before being persisted, so a database compromise alone cannot be used to impersonate an active session.
3. Cross-Site Request Forgery Protection
Every state-changing action on the Platform is protected by a double-submit CSRF token, verified on our servers before the action is processed — a standard defense against a malicious site tricking your browser into performing an action on the Platform without your knowledge.
4. Rate Limiting and Abuse Prevention
Authentication endpoints (login, registration, password reset) are rate-limited to slow down automated credential- guessing attempts. Suspicious patterns are logged and reviewed by our team.
5. Encryption in Transit
All traffic to and from the Platform is encrypted using industry-standard transport-layer security (TLS). We do not serve any part of the Platform over an unencrypted connection.
6. Access Controls
Administrative access to Platform data is role-based: internal team members are granted only the level of access required for their function, and every administrative action — from editing published content to reviewing a submitted project — is recorded in an internal activity log with the identity of the acting team member.
Why this matters: an audit trail isn't only a technical safeguard. It's what lets us answer, precisely, the question every institutional partner eventually asks: who touched this, and when?
7. Data Backups
Our production data is backed up on a regular schedule, allowing us to recover from an operational incident without permanent data loss.
8. Vulnerability Reporting
If you discover a security vulnerability affecting the Platform, report it to security@wearetogether.example. We ask that you report responsibly — allowing us reasonable time to investigate and remediate before any public disclosure — and we commit to acknowledging your report within 2 business days.
9. Incident Response
In the event of a security incident affecting personal data, we follow the notification process described in our Privacy Policy, Section 13 (Data Breach Notification).
10. Ongoing Improvement
Security is not a one-time project. We review our controls on an ongoing basis as the Platform evolves and as the threat landscape changes.
11. Contact
Security questions or reports may be directed to security@wearetogether.example.
12. Version History
| Version | Date | Summary of Changes |
|---|---|---|
| 1.0 | 30 July 2026 | Initial publication of the Security Center. |
Effective Date: 30 July 2026 Last Updated: 30 July 2026