Security and Responsible Disclosure

TopoTopic stores knowledge people care about, so security is part of the product, not an afterthought. Our practices include:

• Encryption in transit (TLS) and encryption at rest for stored data.
• Hosting on AWS in the EU (Ireland, eu-west-1), with access controls scoped to what each component needs.
• Row-level access controls in the database, so requests can only read the data their signed-in user is entitled to.
• Hardened session handling: HTTP-only cookies, short session lifetimes, rotating renewal tokens, browser binding checks, and re-authentication before sensitive actions.
• Malware scanning of uploads before they enter processing.
• Audit logging of security-relevant events and verified, receipt-backed deletion.
• Dependency and release integrity checks in our build and deploy pipeline.

We do not currently claim certification under ISO 27001, SOC 2, or similar frameworks, and we will not claim one until an audit has actually been completed. If a personal data breach occurs that is likely to result in a risk to affected users, we notify the competent supervisory authority and, where required, affected users, in line with Articles 33 and 34 GDPR, as described in the Privacy Policy.

If you believe you have found a security vulnerability in TopoTopic, we want to hear about it. Send a report to support@topotopic.comwith the subject "Security Report". A machine-readable pointer to this policy is published at /.well-known/security.txt.

A useful report includes:

• A description of the issue and where it occurs.
• Steps to reproduce it, ideally with a minimal example.
• What you believe the impact is.
• How we can reach you for follow-up questions.

We aim to acknowledge reports within 5 business days. We will keep you informed of our progress, and we are happy to credit reporters who wish to be named once an issue is fixed. We do not currently run a paid bug bounty program.

We will not pursue action against good-faith security research that stays within these rules:

• Only test against accounts and workspaces you own or created for testing.
• Do not access, modify, or delete other people's data. If you encounter someone else's data accidentally, stop, do not save it, and tell us.
• Do not degrade the Service: no denial-of-service testing, no automated scanning at disruptive volume, and no spam.
• No social engineering of users or people connected with the project.
• Give us a reasonable time to fix the issue before disclosing it publicly, and coordinate the disclosure timing with us.
• Do not use a vulnerability beyond what is needed to demonstrate that it exists.

Testing that follows these rules is authorized use for the purposes of our Acceptable Use Policy. Out of scope: vulnerabilities in third-party services we use (report those to the provider), findings that only work with physical access to a victim's device, and reports generated by automated tools without a demonstrated impact.

We triage reports, reproduce the issue, and fix confirmed vulnerabilities with a priority that matches their impact. Where a vulnerability affected personal data, we assess our notification duties under the GDPR and follow them.

We treat report contents confidentially, and we ask the same of reporters until a coordinated disclosure. Personal data you include in a report is processed to handle the report, as described in the Privacy Policy.