1. Our Commitment to Security
At InkWell, we treat data security as a foundational engineering discipline, not an afterthought. This document outlines the architectural principles, technical controls, and operational procedures we implement to protect user data, published content, and platform infrastructure.
📌 Core Principle
Security is embedded into every layer of our platform. We follow a defense-in-depth strategy, assuming that no single control is sufficient and designing systems that remain secure even when individual components are compromised.
2. Data Protection Lifecycle
We secure data across its entire lifecycle, from creation to deletion. Our approach ensures confidentiality, integrity, and availability at every stage.
In Transit
All data transmitted between clients, APIs, and infrastructure is encrypted using TLS 1.3 with strong cipher suites. HSTS is enforced across all domains.
At Rest
Database volumes, object storage, and backups are encrypted using AES-256. Encryption keys are managed via AWS KMS with strict IAM policies and automatic rotation.
Secure Disposal
Deleted data is cryptographically erased or securely overwritten. Backup retention policies ensure data is purged according to regulatory requirements and user requests.
3. Technical Safeguards & Architecture
Our infrastructure follows industry-leading standards for cloud security, network isolation, and access control.
- Zero-Trust Network: Microsegmentation isolates workloads. No direct internet access to databases or internal services.
- Web Application Firewall (WAF): Custom rulesets block OWASP Top 10 threats, rate-limiting, and bot mitigation at the edge.
- DDoS Protection: Enterprise-grade traffic scrubbing with automatic failover and capacity scaling.
- Multi-Factor Authentication: Required for all administrative access, developer workstations, and customer support systems.
- Role-Based Access Control (RBAC): Principle of least privilege enforced across all services, databases, and CI/CD pipelines.
- Continuous Monitoring: 24/7 SOC monitoring with SIEM integration, anomaly detection, and automated incident playbooks.
4. Compliance & Certifications
We align our security program with recognized frameworks and maintain transparent compliance status.
| Framework / Regulation | Status | Scope |
|---|---|---|
| GDPR (EU) | Compliant | EU user data processing & cross-border transfers |
| CCPA / CPRA (California) | Compliant | Consumer privacy rights & opt-out mechanisms |
| SOC 2 Type II | In Progress | Security, Availability, Confidentiality |
| ISO 27001 | Aligned | Information Security Management System |
| WCAG 2.1 AA | Compliant | Accessibility standards for all interfaces |
5. Data Ownership & User Rights
InkWell respects user sovereignty over personal and published data. We never sell, rent, or monetize user content or personally identifiable information (PII).
✅ Your Rights
You retain full ownership of all articles, comments, and metadata you create. You may export your data in standard formats (JSON, CSV), request correction, or initiate full account deletion. Deletion requests are processed within 30 days with verifiable confirmation.
Third-party integrations (analytics, payment processors, CDN) are bound by strict Data Processing Agreements (DPAs) and undergo annual security reviews.
6. Incident Response & Transparency
We maintain a formalized incident response program aligned with NIST SP 800-61. Our process includes:
- Detection & Triage: Automated alerting combined with manual SOC analysis within 15 minutes of anomalous activity.
- Containment & Eradication: Immediate isolation of affected systems, credential rotation, and root cause analysis.
- Notification: Affected users are notified via email and platform alert within 72 hours of confirmed compromise, as required by regulation.
- Recovery & Post-Mortem: System restoration, validation of security controls, and public transparency report within 30 days.
View our public incident log and annual transparency reports.
Report a Security Concern
We value responsible disclosure. If you discover a vulnerability, have a security inquiry, or need to report suspicious activity, please contact our dedicated security team.