Security

This page describes how the Peripatetical services — CloudMonitor and Grocery Concierge — protect the data you give them. It is written to be checkable rather than reassuring: everything below is either in place today or explicitly named as not in place.

If you only read one paragraph: this is a small, carefully built platform run by one person. The security work is real and deliberate, but it is sized for a service that is not yet handling anyone's production secrets at scale. Where that shows, this page says so.

How your account is protected

Sign-in

All sign-in goes through one central identity service rather than each product keeping its own passwords. In practice that means:

• No password for you to lose. Sign-in is by single-use email link or by your existing organisational account. There is no password database to breach, because there are no passwords.
• Sessions live server-side. Your browser holds a reference, not your identity, so a session can be revoked immediately and centrally.

Where your data sits

• The database is not on the public internet. Public network access is switched off entirely. Applications reach it over a private network path; there is no internet-facing address to attack, and no firewall rule that opens one. This is a standing rule, not a current setting — a service that cannot reach the database gets its networking fixed rather than the database exposed.
• Everything is encrypted in transit (HTTPS/TLS to the site, private networking inside) and at rest (managed disk encryption on the database and file storage).
• Credentials are stored in a managed secret vault, and applications read them using their own machine identity. Nobody carries a copy on a laptop.
• Cloud credentials you connect to CloudMonitor are encrypted with a dedicated key before they are stored, separately from everything else.

Who can see it

• Administrative access is limited to the operator, and reaching an administrative page requires a role that is granted explicitly — not implied by having an account.
• Administrative pages are reachable only over an authenticated session, and every product enforces the role check itself rather than trusting the page it was reached from.
• Administrative access is recorded. Sign-ins, permission changes, denied access attempts, and any export of records are written to an append-only audit log. Nobody, including the operator, can edit or delete an entry through the application.
• That log is what makes an honest answer possible if something ever does go wrong. It exists so that “we don’t know what was accessed” is never the answer you get.

Payments

Payments are handled entirely by Stripe, which acts as merchant of record. Card numbers are never sent to, processed by, or stored on Peripatetical systems — there is no payment form in this codebase to leak them from.

How the platform is maintained

• Dependencies are scanned automatically for known vulnerabilities, and security patches are proposed automatically.
• Every code change goes through review and automated checks before it can reach production. Nobody can push directly to a production branch — that restriction applies to the operator too, and cannot be bypassed.
• Commit history is scanned for leaked credentials on every change to every repository.
• Cloud configuration is continuously assessed against Microsoft's security baseline, so a misconfiguration surfaces rather than sitting unnoticed.
• Database backups are taken continuously with point-in-time restore.

What is deliberately not in place

Every service has gaps. Most security pages omit theirs. Here are the ones that would matter to you, and why they are where they are:

• There is no 24/7 monitored intrusion detection. Nothing watches traffic for attacks in real time and pages a human at 3am. Suspicious activity is recorded and reviewed, not alerted on. If you need continuously-monitored infrastructure today, this is not that yet.
• There has been no third-party penetration test or security audit. No SOC 2 report, no ISO 27001 certificate. Anyone claiming otherwise about this platform is wrong.
• Backups are retained for one week, and are not replicated to a second region. A total loss of the hosting region would mean data loss.
• Application logs are retained for 30 days. An incident discovered after that window would be harder to reconstruct in detail — though the audit log above is retained far longer.
• This is one person. There is no security team, no on-call rotation, and no second pair of eyes. Response time depends on one human being awake.

These are cost and scale decisions, not oversights, and each is written down and tracked. They are reviewed as the services grow — but you are entitled to know the state today rather than the intention.

What is being built right now

Listing this separately rather than describing it as done, because as of the date at the top of this page it is written and reviewed but not yet running in production:

• Rate limiting on sign-in and account-recovery requests, to stop an automated script working through addresses. The limiter is written and deployed but is not yet applied to those endpoints.

This section shrinks as each item ships, and the date above moves when it does.

If something goes wrong

If personal data is ever compromised, the commitment is specific rather than vague:

• Affected people are contacted directly, not informed by a quietly updated web page.
• Notification follows the legal deadlines that apply — including the 72-hour reporting window under GDPR where it is engaged.
• You will be told what was actually accessed, established from the audit log rather than from a worst-case guess or a reassuring one.
• Nothing will be claimed as unaffected until that is a finding rather than a hope.

Reporting a vulnerability

If you find a security problem, please report it through the support form and say clearly in the message that it is a security issue — that routes it straight to the operator.

Please give a reasonable window to fix it before disclosing publicly. Good-faith research is welcome, and reports are read by a person, not a queue. What is asked in return: do not access, modify, or delete data that is not yours, do not degrade the service for other people, and do not use automated scanning heavy enough to look like an attack.

There is no paid bug bounty. This is a pre-revenue project and pretending otherwise would waste your time.

Changes to this page

If a control described here is turned off or materially changed, this page changes with it and the date above moves. It is meant to describe the service as it actually is, not as it was intended to be at launch.