POLICY & PRODUCT TERMS
Security at FollowUpSignal
A factual summary of application controls and the operational checks that remain outstanding.
Effective date and last updated: 26 October 2026. This document is a practical draft for review and is not a statement of legal approval or compliance.
Current application controls
The application uses authenticated sessions, server-side workspace and role checks in supported routes, password hashing, security response headers, rate-limit backstops and structured operational logs. Billing uses a provider-hosted checkout, server-side transaction verification and signed webhook validation.
Public capture and contact routes accept internet traffic and rely in part on process-local rate limiting. That limiter is not shared across application instances. A trusted shared edge limiter is needed for a multi-instance deployment.
Limits and operational status
No independent security audit, penetration test, compliance certification, uptime commitment or database restore drill is claimed. Production backups, alerting, a shared rate limiter and full tenant-isolation verification remain operational work. Security depends on how the operator configures hosting, secrets, database access and integrations.
Do not send credentials or sensitive customer data through the public contact form. This deployment has no monitored security notification channel configured; the operator must publish one before inviting security reports.
These materials must be reviewed and adapted by the business and qualified counsel before public launch. Contact requests submitted through this site are stored for manual review and do not notify a support agent. Contact page.