Security

• The application, database, pipeline and file storage run on DigitalOcean in the United States. The database is encrypted at rest and all connections use TLS.
• Changes reach production only through reviewed pull requests to a protected branch. Each must pass type checking, linting, tests, a full build, and two checks specific to CapitolMath: that every audit-log write goes through the one recording path, and that AI-model calls happen only in the one module built for them.
• Dependencies are monitored for security advisories, with updates proposed automatically and major upgrades planned rather than merged blind.
• Production credentials are never kept in the code repository. They live only in the hosting environment.

• Sign-in is handled by PropelAuth; passwords never reach CapitolMath.
• Roles and licenses separate who can manage the account from who can work with the data, and every request is checked against them on the server.
• API keys are scoped, revocable, shown once, and stored only as a keyed hash.
• Webhooks are signed with a per-webhook secret (stored encrypted, AES-256-GCM) so you can verify each delivery came from us.
• The audit log records sign-ins, member and key changes, exports, webhooks, billing changes and staff access. It is append-only in the database and hash-chained, so a change to any past entry is detectable.
• Forms that change data check that the request came from CapitolMath's own pages.

If we become aware of a breach affecting your data, we'll tell your account's Owners without undue delay and within 72 hours, with what we know, what we're doing, and what you may need to do. The data processing agreement sets this out as a commitment.

Email support@capitolmath.ai with “Security report” in the subject. Tell us what you found, how to reproduce it, and what an attacker could do with it. We'll acknowledge your report within two business days and keep you updated until it's resolved.

Please:

• Test only against your own account, or accounts you have permission to use.
• Don't access, change or keep other people's data. If you reach some by accident, stop, and tell us what you saw.
• Don't degrade the service — no denial-of-service testing, spam, or high-volume automated scanning.
• Give us a reasonable time to fix the problem before telling anyone else.

Our side: if you act in good faith and within these rules, we won't pursue legal action against you for your research, and we'll credit you when the fix ships if you'd like. We don't run a paid bug bounty.

Out of scope: findings that need a compromised device or browser, social engineering of our staff, reports from automated scanners without a demonstrated impact, missing best-practice headers with no exploit, and vulnerabilities in the services we use (please report those to them).

Machine-readable contact details are at /.well-known/security.txt.