Security at Distinctful

Distinctful follows a practical security model aligned with modern security fundamentals: govern risk, identify sensitive systems, protect access and data, detect abnormal behavior, respond to incidents, and recover service safely.

The product is a multi-tenant SaaS application. Customer data is logically scoped by account and user ownership checks, and product code enforces authorization at service and route boundaries before customer data is read or changed. Tenant isolation is a standing engineering contract, not a per-feature decision.

• All traffic is served over HTTPS/TLS.
• Production responses include security headers such as HSTS where applicable.
• Customer data is stored with managed database infrastructure that encrypts data at rest.
• Connected-platform access tokens are additionally encrypted at rest at the application layer.
• Secrets are kept out of client bundles and managed through controlled environment configuration.
• Payment card data is handled by Stripe or another designated payment processor, not stored by Distinctful.
• Data access is limited to what is needed to operate, support, debug, secure, and improve the Service.

Changes to Distinctful ship through version control and automated checks appropriate to the surface, including type checks, linting, automated tests, and build verification. Changes that touch authentication, authorization, billing, or connected-platform tokens receive additional scrutiny as high-risk surfaces.

The codebase enforces standing security contracts in code review and CI, including authentication-first route handling, input validation at API boundaries, tenant ownership checks before mutations, and secret and signature verification on webhooks and background jobs before side effects run.

Distinctful uses managed authentication infrastructure and application-level authorization checks to protect account access. Sensitive product operations validate the authenticated user and the ownership of the resource being accessed. Mutating endpoints are rate-limited to reduce abuse.

Internally, production access is limited to a small number of authorized operators, follows least privilege, and uses strong authentication. Customers are responsible for protecting their login methods, controlling access to their email account, reviewing connected platform permissions, and disconnecting providers they no longer want Distinctful to access.

Distinctful uses OAuth or other provider-approved authorization flows where available. We never ask users to share third-party platform passwords. OAuth scopes are requested based on the integration's purpose, tokens are encrypted at rest, and tokens are used only server-side to deliver the product workflows the user authorizes.

You can disconnect supported platforms in Distinctful settings or through the provider's own authorization controls. Disconnecting a provider removes or invalidates Distinctful's stored access where technically supported.

Distinctful uses logging, error monitoring, queue and runtime checks, and deployment health signals to identify failures and suspicious behavior. When a security incident is suspected, we prioritize containment, investigation, credential or token rotation where needed, remediation, and legally required notification to affected customers.

If a provider outage or API change affects a connected workflow, Distinctful may pause syncs, disable affected functionality, surface recovery guidance, or require users to reconnect a platform. We prefer a degraded-but-honest product state over silently wrong data.

Distinctful runs on managed cloud infrastructure with provider-level redundancy. We design recovery around managed infrastructure, durable workflow records, and documented operational procedures, and we continue to test and improve those procedures as the Service evolves.

Distinctful relies on reputable infrastructure and service providers for hosting, authentication, database, payments, email, analytics, monitoring, queues, and connected-platform APIs. These providers operate their own audited security programs, and their posture is part of our overall risk model, but each provider remains responsible for its own systems.

Distinctful does not claim that every provider, integration, or connected platform offers identical security controls, availability, retention rules, or compliance posture.

Distinctful is not designed for regulated health information, classified data, payment card storage, or other categories that require specialized compliance programs unless a separate written agreement says otherwise.

Distinctful does not currently hold SOC 2, HIPAA, PCI DSS, or ISO 27001 certification as an organization, and we will not claim a certification we do not have. We build with providers that maintain their own security and compliance programs, and we handle personal data as described in our Privacy Policy.

If you believe you found a vulnerability, email security@distinctful.com with a concise description, the affected URL or endpoint, reproduction steps, impact, and your contact information. We review every credible report, prioritize by severity, and will keep you informed of the outcome where we can.

Act in good faith: do not access, modify, delete, exfiltrate, or disclose data that does not belong to you; do not degrade service, run destructive tests, use social engineering, or test against third-party providers; and give us reasonable time to remediate before public disclosure. We will not pursue legal action against researchers who follow these guidelines in good faith. We do not currently operate a paid bug bounty program.

• Use a secure email account and strong authentication for your Distinctful login.
• Grant only the third-party platform permissions you intend to use.
• Review connected platforms periodically and disconnect what you no longer need.
• Avoid placing regulated, highly sensitive, or unnecessary personal data into Distinctful.
• Report suspected account compromise or unauthorized provider activity promptly.