Hosting
- We host on Vercel. Vercel holds SOC 2 Type II.
- Every connection uses HTTPS, with TLS 1.2 or newer.
- Vercel’s network blocks flood attacks (DDoS).
- No passwords or keys live in our code. They live in locked settings.
Security
Security by default. Built in from day one.
We lock your data inside layers. Here is each one, and what we do if something goes wrong.
How we protect your data. One layer at a time.
We do not take card payments ourselves. Your payment processor does that. We do not store health records covered by HIPAA.
Sign-in and access
- Two-factor sign-in on every admin system: GitHub, Vercel, Convex, Stripe and hosting.
- Apps we build ask for a second sign-in step before they link a bank account.
- Each person on a project can reach only what their job needs.
- We remove access when a project ends.
- Sensitive actions go into an audit log.
Your data
- Stored data is encrypted with AES-256, through Convex and Vercel.
- Data on the move is encrypted with TLS 1.2 or newer.
- Your logins live in encrypted vaults and nowhere else.
- We write down how long each project keeps data. Our Privacy Policy says it too.
How we build
- Every change is reviewed before it goes live.
- We check the code we use from others for known security holes.
- Test, staging and live systems stay apart.
- Your data stays in the cloud. Our laptops hold code, not your data.
Standards we meet. And where we stop.
Through our host
SOC 2
Vercel holds SOC 2 Type II. We inherit its hosting controls. We are not SOC 2 certified on our own.
Ready
GDPR
We sign a data processing agreement for EU data when you ask.
Compliant
CCPA
We honor the privacy rights California gives you. Our Privacy Policy says how.
Not a bank
GLBA
We are a technology provider, not a financial institution under GLBA. Bank data goes through regulated providers.
If something goes wrong, you hear from us fast.
If a security problem hits your project, here is what we do.
- Within 24 hoursWe tell you what we found.
- Within 48 hoursYou get our first assessment.
- Within 7 daysYou get the full incident report.
- As soon as we canWe put the fix in place.
Found a security issue? Tell us.
Email us what you found. The rules are below.
We read every report. We answer within 24 hours.
- In scope
- miamiweb.ai, portal.miamiweb.ai and our public services.
- Out of scope
- Services we depend on, like Vercel, Convex, Stripe and Cloudflare. Tricking our staff or contractors. Physical attacks. Denial-of-service or stress tests.
- Safe harbor
- We will not take legal action against good-faith researchers who follow this policy. Give us at least 90 days to fix an issue before you publish it.
- Response times
- We confirm within 24 hours. We sort it within 72 hours. Within 7 days we tell you when the fix will land.
How long we keep your data. Only as long as we need it.
- A linked bank account
- 30 days
- 30 days after you unlink it or stop the service.
- Your account
- 90 days
- 90 days after we stop working together.
- Security logs
- 12 months
- 12 months.
- Imported transactions
- 24 months
- The latest 24 months. That matches the provider’s default.
- Billing and tax records
- 7 years
- 7 years. The IRS requires it.
The full table is in our Privacy Policy, section 7.
We keep a record of changes to this page. Ask security@miamiweb.ai for the dated list.