Security at SoyPre

Our Commitment to Security

At SoyPre, security is fundamental to everything we do. We understand that you trust us with what you scan and the preferences you set, and we take that responsibility seriously. Our security practices are designed to protect your information while maintaining the transparency and independence that define our mission.

Data Security

Encryption

• In Transit: All data transmitted between your device and our servers is encrypted with TLS, and the app only trusts our servers' certificates (certificate pinning)
• At Rest: Stored data is encrypted at rest (AES-256) by our database and storage providers

Infrastructure Security

• Cloud Provider: A globally distributed edge network and enterprise-grade managed database hosting in Asia
• Data Centers: Our providers run certified data centers with physical security controls and redundancy
• Network Security: DDoS protection and a Web Application Firewall (WAF) in front of every public endpoint
• Access Control: Our admin tools sit behind an identity-aware access gateway, and only a few named people can change data. Each system secret has exactly one consumer

Application Security

• Checks Before Every Deploy: Type-checking and automated tests run on every change, and we deploy only through our CI pipeline
• Dependency Scanning: Automated alerts for vulnerable dependencies
• Signed Requests: Every request from the app is signed and protected against replay
• Input Validation: Every endpoint validates its input against a schema before using it

Mobile App Security

• Secure Storage: Your sign-in session is kept in the iOS Keychain or Android Keystore, never in plain app storage
• Certificate Pinning: Protection against man-in-the-middle attacks
• App Store Security: Apps distributed only through official Apple App Store and Google Play Store

Privacy by Design

• Data Minimization: We only collect data necessary for app functionality
• No Advertising Trackers in the App: No ad networks, no attribution SDKs, no social media trackers. The only third-party tools we run are diagnostic - crash and performance monitoring, and aggregate website analytics - plus, on the website only and only if you accept the Marketing cookies, the Google Ads tag. They are all listed in the Privacy Policy
• No Data Selling: We never sell or share your data with third parties
• Local Processing: What the camera sees while scanning is read on your device and is never uploaded
• Anonymization: Aggregate data is fully anonymized before any research use

Compliance & Certifications

• GDPR: We honour the rights the EU General Data Protection Regulation gives you (see the Privacy Policy)
• CCPA: We honour the rights the California Consumer Privacy Act gives you
• App Store Guidelines: Compliant with Apple and Google privacy requirements

Incident Response

We have a comprehensive incident response plan in place:

• Monitoring: Automated alerts for errors and suspicious activity
• Rapid Response: We act on security reports as soon as we see them
• User Notification: We will notify affected users within 72 hours of any data breach
• Transparency: Public disclosure of security incidents on our security page
• Post-Mortem: Detailed analysis and preventive measures after any incident

Responsible Disclosure

We appreciate the security research community's efforts to help keep SoyPre secure. If you discover a security vulnerability, please report it responsibly:

How to Report

Send details to security@soypre.com with:

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact assessment
• Your contact information (optional, for updates)

Our Commitment to Researchers

• Acknowledgment: We'll respond within 48 hours
• Updates: Regular status updates on the fix timeline
• Credit: Public acknowledgment (if desired) after issue resolution
• No Legal Action: We won't pursue legal action against good-faith security research

Safe Harbor

When conducting security research according to this policy, we consider your actions authorized and will not pursue legal action. We ask that you:

• Make every effort to avoid privacy violations and data destruction
• Do not exploit the vulnerability beyond what's necessary to demonstrate it
• Give us reasonable time to fix the issue before public disclosure
• Do not access or modify other users' data

Third-Party Services

We carefully vet all third-party services we use:

• Cloud Infrastructure: Enterprise-grade providers with strong security track records
• Security Posture: We choose providers that publish their security and compliance standards
• Data Processing Agreements: GDPR-compliant contracts with all data processors
• Minimal Integration: We use third-party services only when essential

Important: We run no advertising networks and no tracking services. The few third-party tools we do use are diagnostic or operational (error monitoring, aggregate action counts, memberships, sign-in) and are listed in the Privacy Policy.

Access to Our Systems

• Few People: Access to production systems is limited to the few people who run SoyPre
• Separate Secrets: Production and development use separate databases and keys, and secrets are never committed to code

Questions?

If you have questions about our security practices, please contact our security team:

Email: security@soypre.com