Security Practices
How we protect your data and privacy
As a privacy protection company, security is at the heart of everything we do. We take extensive measures to ensure your personal information is safe with us while we work to remove it from data broker databases.
End-to-End Encryption
All data transmitted between your browser and our servers is encrypted using TLS 1.3. Sensitive data at rest is encrypted with AES-256.
Secure Infrastructure
Our servers are hosted on SOC 2 compliant infrastructure with 24/7 monitoring, automated threat detection, and regular security patches.
Access Controls
Strict role-based access controls ensure only authorised personnel can access user data. All access is logged and audited.
Minimal Data Collection
We only collect the information necessary to perform data removal on your behalf. We never sell or share your data with third parties.
Regular Security Audits
We conduct regular penetration testing and vulnerability assessments to identify and address potential security risks.
Compliance
We comply with GDPR, CCPA, and other data protection regulations. Our practices are designed to meet or exceed industry standards.
Password Security
User passwords are never stored in plain text. We use bcrypt hashing with salt rounds to ensure that even in the unlikely event of a data breach, passwords remain protected. We also support password reset flows with time-limited, single-use tokens.
Payment Security
All payment processing is handled by Stripe, a PCI DSS Level 1 certified payment processor. We never store, process, or have access to your full credit card numbers. Your financial information goes directly to Stripe's secure servers.
Data Handling During Removal
When we submit removal requests to data brokers on your behalf, we share only the minimum information required to identify and remove your records. This typically includes:
- - Your name (to identify records to be removed)
- - Your email address (for broker confirmation)
- - City and state (only when needed to narrow down records)
Incident Response
In the event of a security incident, we have a documented response plan in place. We will notify affected users within 72 hours in accordance with GDPR requirements and take immediate steps to contain and remediate the issue.
Report a Security Issue
If you discover a security vulnerability, please report it to us responsibly. Contact our security team and we will investigate promptly.
Security Team
Email: support@protectmydata.com