Security at Settl

• All data in transit is protected by TLS 1.2 / TLS 1.3. Older protocols are disabled.
• Data at rest is encrypted using AES-256 via Supabase (PostgreSQL on AWS).
• Backups are encrypted at rest and retained for 7 days.

• Admin access requires a strong secret key and issues a short-lived HS256 JWT (24-hour expiry).
• Session tokens are stored in httpOnly, Secure, SameSite=Strict cookies, not accessible to JavaScript.
• All admin routes verify the JWT signature on every request at the middleware layer.
• Admin login is rate-limited to 5 attempts per 15 minutes per IP (Redis-backed, restart-proof).
• Landlord portal access uses time-limited magic links protected by signed JWT tokens.

• Application server bound to localhost only, not exposed directly to the internet.
• Nginx reverse proxy with connection limiting and slowloris protection enabled.
• UFW firewall: only ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) are open.
• Fail2ban monitors SSH and Nginx logs; repeated failures trigger automatic IP bans.
• Root SSH login is disabled; key-based authentication only.
• Environment secrets stored in a chmod 600 file, never committed to version control.

• Plaid: bank-level OAuth for income and transaction verification. Settl never stores raw bank credentials.
• DiDit: biometric identity verification. KYC data is processed under DiDit's ISO 27001-aligned infrastructure.
• Square: PCI-DSS Level 1 certified payment processing. Settl never touches raw card numbers.
• Supabase: PostgreSQL database with row-level security policies. Anon API key cannot insert or read sensitive tables.

• FCRA: Settl runs soft pull credit checks (VantageScore 4.0 via TransUnion) and criminal/eviction checks via CRS. All verification is consent-based, disclosed to applicants, and subject to FCRA dispute rights.
• Fair Housing: landlords receive verification tiers and income ceilings only; no race, religion, or protected-class data is collected or transmitted.
• SOC 2 Type II: planned. We are building toward formal audit readiness.

If you discover a security vulnerability in Settl, please report it to us privately before disclosing it publicly. We commit to acknowledging your report within 90 days.

Contact: [email protected]

Please include a clear description of the issue, steps to reproduce, and your assessment of the potential impact. We do not currently offer a monetary bug bounty, but we will acknowledge confirmed findings.