Security is foundational. We don't treat it as a marketing checkbox - the architecture is intentionally simple to keep the attack surface small.
Hosting
- Application: Vercel (US primary compute region, global CDN edge).
- Database: self-hosted PostgreSQL on Oracle Cloud Infrastructure (UK region). Self-hosting gives us full control of access, backups, and tuning.
- Jobs: Trigger.dev (UK region) for scheduled tasks that exceed Vercel cron limits.
Encryption
- TLS 1.2 or higher for all traffic. HSTS enabled.
- Database disks encrypted at rest.
- OAuth tokens (eBay, etc) encrypted at rest using application-level encryption.
- Passwords are hashed by our authentication provider Clerk using industry-standard algorithms; we never store or see plaintext passwords.
Access controls
- SSH access to production hosts is key-only; root password login is disabled.
- fail2ban active on production hosts.
- Per-tenant data isolation enforced at the application layer; every protected route checks ownership before reading or writing.
- Multi-factor auth available on user accounts via Clerk.
Monitoring and incident response
- Sentry captures every unhandled error with a request ID threaded through.
- Structured logs land in our log pipeline; warnings and errors forward to Sentry.
- Activity audit trail records every meaningful user action.
- Daily security patches applied via dnf-automatic on production hosts.
Backups
Database backups run nightly to object storage and are retained for 14 days.
SOC 2 / ISO 27001
We are not currently certified. We follow many of the practical controls (access review, encryption, change management, vendor risk) but a formal audit is on the roadmap, not done.
Reporting a vulnerability
Email security@deltapp.iowith details and a reproduction. We respond within 48 hours. We don't run a bug bounty programme yet but we're grateful for responsible disclosure and credit researchers in our changelog.