Security and Responsible Disclosure

• Encryption in transit (TLS) and encryption at rest for databases and file storage.
• Hosting at AWS in the EU (Ireland, eu-west-1), with access rights scoped to what each component needs.
• Authenticated route, role and workspace checks, with database row-level security on many content tables. Not every content table relies on row-level security.
• Session handling with HTTP-only cookies, short session lifetimes, rotating renewal tokens, a browser binding check, and re-authentication before sensitive actions.
• Upload validation, and malware scanning where the file type and upload path require it. A required scan must pass before processing. A scan cannot guarantee that a file is harmless.
• Audit logging of security-relevant events, and verified deletion with a receipt for sessions.
• Operator access to user content only for the purposes stated in the Privacy Policy, with a recorded reason for each access.
• Dependency, signature and provenance checks in the build and release pipeline.

Authorization tokens for Google services that you connect are protected by database encryption at rest and by database access rights. They are not additionally encrypted by the application.

We hold no certification under ISO 27001, SOC 2 or a similar framework and will not claim one before an audit has been completed. If a personal data breach is likely to result in a risk to the people affected, we notify the supervisory authority and, where Articles 33 and 34 GDPR require it, those people.

We are preparing Protected Memory: application-level encryption for private recordings, uploads, notes, messages, derived text and search data. Production activation is still pending. New content is not yet encrypted by this layer, and migration of existing content is incomplete. The storage encryption described above remains in place.

Once activated, this layer encrypts covered content before database and file storage, with keys managed by a separate custody service. Necessary account, ownership, timing and processing metadata remains readable. Earlier backups, file versions and provider copies remain subject to their retention rules.

This is server-managed encryption, not end-to-end encryption. Trusted TopoTopic services decrypt content to provide features, and processing providers receive the content needed for those features as described in the Privacy Policy. A compromised backend or administrator with sufficient privileges can still access content.

The application checks current ownership, workspace membership and sharing permissions before content access. Key custody authenticates backend services and checks which workspace and content a key belongs to; it does not independently verify each user's permissions.

If you believe you have found a security vulnerability in TopoTopic, write to support@topotopic.com with the subject "Security Report". The same contact is published at /.well-known/security.txt.

A useful report contains:

• what the issue is and where it occurs;
• steps to reproduce it, ideally with a minimal example;
• what you believe the impact is;
• how we can reach you.

We prioritize reports by likely impact and do not promise a fixed response time. We credit reporters who want to be named once an issue is fixed. We do not run a paid bug bounty program.

If you follow these rules, we will not bring a civil claim against you or file a criminal complaint because of your research, and we treat your testing as authorized use under the Acceptable Use Policy. We cannot bind other people or the authorities.

• Test only against accounts and workspaces that you own or created for testing.
• Do not access, change or delete other people's data. If you come across it by accident, stop, do not keep it, and tell us.
• Do not degrade the Service: no denial-of-service testing, no automated scanning at disruptive volume, no spam.
• Do not use social engineering against users or people connected with TopoTopic.
• Do not exploit a vulnerability beyond what is needed to show that it exists.
• Give us reasonable time to fix the issue before you disclose it, and agree the timing of disclosure with us.

Out of scope: vulnerabilities in third-party services we use (report those to the provider), findings that require physical access to a victim's device, and output of automated tools without a demonstrated impact.

We reproduce the issue and fix confirmed vulnerabilities with a priority that matches their impact. Where a vulnerability affected personal data, we assess and follow our notification duties under the GDPR.

We keep the content of your report confidential and ask the same of you until a coordinated disclosure. We process the personal data in your report to handle it, as the Privacy Policy describes.