Security & Compliance

Comprehensive security measures, compliance standards, and best practices for StateSet platform

Our Commitment to Security

At StateSet, security isn’t just a feature—it’s the foundation of everything we build. We understand that our customers trust us with their most valuable business data, and we take that responsibility seriously. Our comprehensive security program ensures your data is protected at every level.

Certification

StateSet holds SOC 2 Type I.

SOC 2 Type I

An independent auditor’s assessment that our security controls are suitably designed as of a point in time, covering security, availability, processing integrity, and confidentiality.

What Type I is and is not. A Type I report evaluates whether controls are designed appropriately at a specific date. A Type II report goes further and tests whether those controls operated effectively over a period, typically 6–12 months. We hold Type I and do not claim Type II.

If your procurement process requires a Type II report, tell us — that is a fair requirement and we would rather you hear it from this page than discover it in a security review.

Our information-security practices — risk assessment, incident response, business continuity, and continuous improvement — follow ISO 27001 as a framework. That is a description of how we work, not a certification, and we hold no ISO 27001 certificate.

Platform Security Architecture

Data Protection

Encryption

Data in Transit

• TLS 1.3 for all API communications
• Perfect Forward Secrecy (PFS)
• HSTS (HTTP Strict Transport Security)
• Certificate pinning for mobile apps

Data at Rest

• AES-256 encryption for all stored data
• Encrypted database volumes
• Secure key management with AWS KMS
• Automatic key rotation every 90 days

Access Controls

Identity & Access Management

• Multi-factor authentication (MFA) required
• Role-based access control (RBAC)
• Principle of least privilege
• Regular access reviews and audits

API Security

• Rate limiting and throttling
• IP allowlisting capabilities
• API key rotation and management
• Request signing and verification

Infrastructure

Cloud Security

• AWS enterprise-grade infrastructure
• VPC isolation and network segmentation
• Web Application Firewall (WAF)
• DDoS protection and mitigation

Monitoring & Detection

• 24/7 security operations center (SOC)
• Real-time threat detection
• Automated incident response
• Comprehensive audit logging

API Security Best Practices

Authentication & Authorization

// ✅ Secure API key usage
const client = new StateSetClient({
  apiKey: process.env.STATESET_API_KEY, // Use environment variables
  baseURL: 'https://api.stateset.com/v1',
  timeout: 30000,
  retries: 3
});

// ✅ Implement proper error handling
try {
  const customer = await client.customers.create({
    email: '[e-mail]',
    name: 'John Doe'
  });
} catch (error) {
  if (error.code === 'UNAUTHORIZED') {
    // Handle authentication errors
    logger.error('Invalid API key or expired token');
    // Don't log sensitive information
  } else if (error.code === 'RATE_LIMIT_EXCEEDED') {
    // Handle rate limiting
    const retryAfter = error.headers['retry-after'];
    logger.warn(`Rate limited. Retry after ${retryAfter} seconds`);
  }
  throw error;
}

Secure Webhook Implementation

// ✅ Verify webhook signatures
const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload, 'utf8')
    .digest('hex');
    
  return crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expectedSignature, 'hex')
  );
}

// ✅ Secure webhook endpoint
app.post('/webhooks/stateset', express.raw({type: 'application/json'}), (req, res) => {
  const signature = req.headers['x-stateset-signature'];
  const isValid = verifyWebhookSignature(
    req.body,
    signature,
    process.env.STATESET_WEBHOOK_SECRET
  );
  
  if (!isValid) {
    return res.status(401).send('Unauthorized');
  }
  
  // Process webhook safely
  const event = JSON.parse(req.body);
  // Handle event...
  
  res.status(200).send('OK');
});

Data Privacy & Compliance

GDPR Compliance

Data Rights

Customer Rights Management

• Right to access personal data
• Right to rectification and deletion
• Data portability and export
• Automated consent management

Privacy by Design

Built-in Privacy Features

• Data minimization principles
• Purpose limitation controls
• Automated data retention policies
• Privacy impact assessments

Data Residency & Sovereignty

{
  "data_regions": {
    "us_east": {
      "location": "United States (Virginia)",
      "compliance": ["SOC2_TYPE_I"],
      "encryption": "AES-256-GCM"
    },
    "eu_west": {
      "location": "European Union (Ireland)",
      "compliance": ["GDPR"],
      "encryption": "AES-256-GCM"
    },
    "ap_southeast": {
      "location": "Asia Pacific (Singapore)",
      "compliance": ["PDPA", "ISO27001"],
      "encryption": "AES-256-GCM"
    }
  }
}

Security Operations

Incident Response

1. Detection

   Automated Monitoring

   • Real-time security event correlation
   • Anomaly detection and alerting
   • Threat intelligence integration
   • 24/7 security operations center
2. Response

   Rapid Response Protocol

   • < 15 minutes: Initial assessment
   • < 1 hour: Containment measures
   • < 4 hours: Customer notification (if applicable)
   • < 24 hours: Resolution and remediation
3. Recovery

   Business Continuity

   • Automated failover systems
   • Data backup and restoration
   • Service availability maintenance
   • Post-incident review and improvements

Vulnerability Management

• Regular Security Assessments: Quarterly penetration testing by certified third parties
• Automated Scanning: Daily vulnerability scans across all systems
• Patch Management: Critical security patches applied within 24 hours
• Bug Bounty Program: Responsible disclosure with security researchers

Compliance & Auditing

Regular Audits

SOC 2 Type I

Independent Controls Assessment

• Independent security controls testing
• Control design evaluation
• Customer report availability on request

Penetration Testing

Quarterly Security Testing

• External penetration testing
• Application security assessment
• Network infrastructure testing

Internal Reviews

Continuous Monitoring

• Monthly access reviews
• Quarterly risk assessments
• Annual policy updates

Audit Logging

All API requests and administrative actions are logged with:

{
  "timestamp": "2024-01-15T10:30:00Z",
  "event_type": "api_request",
  "user_id": "usr_12345",
  "api_key_id": "key_67890",
  "endpoint": "/v1/customers",
  "method": "POST",
  "ip_address": "203.0.113.0",
  "user_agent": "StateSet-SDK/1.0.0",
  "response_code": 201,
  "response_time_ms": 150,
  "request_id": "req_abcd1234"
}

Security Best Practices for Developers

Environment Security

Never commit secrets to version control

Use environment variables or secure secret management systems:

# ✅ Environment variables
export STATESET_API_KEY="your_secure_api_key"
export STATESET_WEBHOOK_SECRET="your_webhook_secret"

# ✅ Using a .env file (add to .gitignore)
STATESET_API_KEY=your_secure_api_key
STATESET_WEBHOOK_SECRET=your_webhook_secret

API Key Management

Best Practices

Secure Key Management

• Rotate API keys every 90 days
• Use different keys for different environments
• Implement key-level monitoring and alerting
• Revoke unused or compromised keys immediately

Access Patterns

• Use read-only keys when possible
• Implement IP allowlisting for production keys
• Monitor for unusual usage patterns
• Set up automated key rotation

Implementation

// ✅ Secure configuration
const config = {
  apiKey: process.env.STATESET_API_KEY,
  environment: process.env.NODE_ENV,
  allowedIPs: process.env.ALLOWED_IPS?.split(','),
  timeout: 30000,
  retries: 3,
  retryDelay: 1000
};

// ✅ Key validation
if (!config.apiKey || !config.apiKey.startsWith('sk_')) {
  throw new Error('Invalid StateSet API key format');
}

// ✅ Environment checks
if (config.environment === 'production' && !config.allowedIPs) {
  console.warn('Production environment without IP allowlisting');
}

Contact & Support

Security Team

For security-related inquiries:

• Security Issues: [e-mail]
• Compliance Questions: [e-mail]
• Trust Portal: trust.stateset.com
• Status Page: status.stateset.com

Emergency Response

For security emergencies requiring immediate attention:

24/7 Security Hotline

Critical Security Issues

• Phone: +1 (555) SECURITY
• Email: [e-mail]
• Response Time: < 15 minutes

---

Continuous Improvement

Our security program is continuously evolving. We regularly review and update our practices based on emerging threats, industry best practices, and customer feedback. For the latest security updates and advisories, visit our trust portal.