Security Policy

Last updated: November 29, 2025

1. Introduction

At Gathery, security is fundamental to our mission of providing professionals with a trusted platform for client document intake. This Security Policy outlines our commitment to protecting your data and the measures we implement to maintain the highest standards of security.

We understand that our customers entrust us with sensitive documents and personal information. This responsibility drives every decision we make about our infrastructure, processes, and people.

2. Scope

This policy applies to:

  • All Gathery services, applications, and infrastructure
  • All employees, contractors, and third-party service providers
  • All data processed, stored, or transmitted by Gathery
  • All customer accounts regardless of subscription tier

3. Data Protection

3.1 Encryption

All data is protected using industry-standard encryption:

  • In Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.3 with strong cipher suites. We enforce HTTPS on all connections and use HSTS to prevent downgrade attacks.
  • At Rest: All stored data, including uploaded files and database contents, is encrypted using AES-256 encryption. Encryption keys are managed using industry-standard key management practices.
  • Backups: All backup data is encrypted using the same standards as primary data storage.

3.2 Data Classification

We classify data into categories to ensure appropriate handling:

  • Confidential: Customer uploaded files, personal identification documents, financial records
  • Internal: Account information, usage logs, system configurations
  • Public: Marketing materials, public documentation

3.3 Data Retention and Deletion

We follow strict data retention practices:

  • Uploaded files are automatically deleted after the configured retention period (1 to 90 days depending on portal settings)
  • Deleted files are removed from active systems according to our retention and deletion processes
  • Account data is retained for 30 days after account closure to allow for recovery, then permanently deleted
  • Audit logs are retained for 2 years for compliance purposes

4. Access Control

4.1 Authentication

We implement robust authentication mechanisms:

  • Passwords are hashed using Argon2id, the most secure password hashing algorithm currently available
  • Rate limiting protects against brute force and credential stuffing attacks
  • Session tokens are securely generated using cryptographically secure random number generators
  • Sessions automatically expire after periods of inactivity

4.2 Authorization

Access to data is strictly controlled:

  • Multi-tenant architecture ensures complete data isolation between accounts
  • Portal access is controlled via unique, unguessable URLs with high entropy
  • Owner-side audit events, including uploads, downloads, deletes, and related admin actions, are logged for audit purposes

4.3 Employee Access

Internal access to customer data is tightly restricted:

  • Principle of least privilege: employees only have access to systems necessary for their role
  • Production access requires additional authentication and is logged
  • Customer data access requires documented justification and approval

5. Infrastructure Security

5.1 Cloud Infrastructure

Our infrastructure is built on enterprise-grade cloud platforms:

  • Hosted in SOC 2 Type II certified data centers
  • Geographic redundancy ensures high availability
  • Infrastructure as Code (IaC) ensures consistent, auditable deployments
  • Automatic scaling to handle demand without service degradation

5.2 Network Security

Multiple layers of network protection:

  • Web Application Firewall (WAF) protects against common web attacks
  • DDoS protection at the network edge
  • Network segmentation isolates critical systems
  • Intrusion detection and prevention systems monitor for threats

5.3 Malware Protection

All uploaded files undergo security scanning:

  • Files are quarantined upon upload until scanned
  • ClamAV-based scanning detects known malware signatures
  • Infected files are automatically blocked and never made available for download
  • Scan definitions are updated daily to protect against new threats

6. Security Operations

6.1 Monitoring and Logging

Comprehensive monitoring ensures visibility:

  • Centralized logging of all system and application events
  • Real-time alerting for security-relevant events
  • Log retention for compliance and forensic purposes
  • Regular log analysis to detect anomalies

6.2 Incident Response

We maintain a documented incident response program:

  • Defined incident classification and escalation procedures
  • 24/7 on-call rotation for security incidents
  • Regular incident response drills and tabletop exercises
  • Post-incident reviews to improve processes
  • Customer notification within 72 hours of confirmed data breaches

6.3 Vulnerability Management

Proactive identification and remediation of vulnerabilities:

  • Regular automated vulnerability scanning of all systems
  • Defined SLAs for vulnerability remediation based on severity
  • Continuous dependency monitoring for known vulnerabilities

7. Business Continuity

7.1 Backups

Comprehensive backup strategy:

  • Automated daily backups of all critical data
  • Backups stored in geographically separate locations
  • Regular backup restoration testing
  • Point-in-time recovery capability

7.2 Disaster Recovery

Documented disaster recovery procedures:

  • Annual disaster recovery testing
  • Multi-region failover capability

8. Vendor Management

We work with third-party vendors that help us operate the service:

  • We evaluate vendors before using them for core service functions
  • We use contractual terms to address data protection responsibilities where appropriate
  • We review vendor fit and security posture over time
  • We limit data sharing with vendors to what is needed for their role

9. Security Training

All employees receive security training:

  • Security awareness training during onboarding
  • Annual refresher training for all employees
  • Role-specific training for technical staff
  • Regular phishing simulations and awareness exercises

10. Vulnerability Disclosure

We welcome responsible disclosure of security vulnerabilities:

  • Report vulnerabilities to: Security at Gathery
  • We aim to acknowledge reports within 24 hours and provide initial assessment within 72 hours
  • We do not pursue legal action against good-faith reporters
  • Public disclosure is coordinated after remediation is complete

11. Policy Updates

This policy is reviewed and updated as needed:

  • Annual review at minimum
  • Updates following significant changes to systems or threats
  • Material changes communicated to customers

12. Contact

For security-related inquiries:

  • Email: Security at Gathery
  • For urgent security incidents, please include "URGENT" in the subject line