Security & Compliance

Caratly is built with a security-first approach. We understand that in the jewellery industry, trust and data integrity are paramount. Here is how we protect your data.

1. Infrastructure Security

Our infrastructure is hosted on world-class cloud providers (AWS/Vercel) with ISO 27001 certification. We utilize:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using valid TLS (Transport Layer Security) protocols.
• Encryption at Rest: Sensitive data stored in our databases is encrypted using industry-standard AES-256 encryption.
• DDoS Protection: We employ advanced DDoS mitigation strategies including Cloudflare integration.

2. Application Security

We follow secure coding practices to prevent common vulnerabilities:

• Authentication: We use secure, token-based authentication (JWT) with protection against session hijacking.
• Input Validation: All user inputs are sanitized to prevent SQL injection, XSS (Cross-Site Scripting), and other injection attacks.
• Access Control: Strict Role-Based Access Control (RBAC) ensures users only access data they are authorized to see.

3. Compliance

We verify our compliance with legal and regulatory requirements regularly including GDPR and CCPA where applicable.

4. Reporting Vulnerabilities

We value the contributions of the security research community. If you believe you have found a vulnerability in Caratly, please report it to us at security@caratly.co. We will investigate all reports and prioritize valid vulnerabilities.