Our Security Commitment

At #about, security isn't an afterthought—it's the foundation of everything we build. We maintain continuous monitoring, regular third-party audits, and strict access controls to ensure your data remains confidential, intact, and available only to authorized personnel.

🔐

Encryption by Default

All data is encrypted in transit (TLS 1.3) and at rest (AES-256). No plaintext storage is permitted under any circumstances.

🛡️

Zero-Trust Architecture

Every request is authenticated and authorized. We enforce strict role-based access control (RBAC) and least-privilege principles.

📊

Continuous Monitoring

24/7 automated threat detection, log auditing, and real-time anomaly alerts ensure immediate response to potential vulnerabilities.

Compliance & Standards

We align our security practices with globally recognized frameworks and regional privacy laws to ensure full legal and operational compliance.

Active

SOC 2 Type II

Annually audited by independent third parties for security, availability, and confidentiality controls.

Compliant

GDPR & CCPA

Full transparency in data collection, processing, and user rights management across EU and California jurisdictions.

Certified

ISO 27001:2022

Information Security Management System (ISMS) implemented and certified for risk-based security governance.

In Progress

HIPAA Alignment

Technical and administrative safeguards in place for environments handling protected health information.

Data Lifecycle Management

We maintain strict governance over how data is collected, stored, used, and ultimately destroyed.

1

Collection

Minimal data collection, explicit consent, and clear privacy notices.

2

Processing

Secure environments, pseudonymization, and purpose-limited usage.

3

Storage

Encrypted at rest, geo-redundant backups, and isolated environments.

4

Retention

Automated lifecycle policies with configurable retention periods.

5

Deletion

Secure wiping, cryptographic erasure, and audit-trail verification.

Incident Response & Transparency

In the event of a security incident, we follow a structured, time-bound response protocol to contain, investigate, and remediate.

Detection

Automated alerts & manual review within 15 minutes

Containment

Isolation of affected systems within 1 hour

Notification

Client & regulatory alerts within 24-72 hours as required

Resolution

Post-incident review, patching, and transparent reporting

Security & Privacy Inquiries

For technical security questions, vulnerability reporting, or data access requests, our dedicated security team is available to assist.

🔒 Contact Security Team
PGP Key: Fingerprint 0xABCD 1234 5678 EF90 Breach Reporting: abuse@about.com Privacy Requests: privacy@about.com