Security

Security is a first-class concern at RingTime. We follow defense-in-depth practices and continually improve our posture. The summary below applies to The HITS App and all RingTime-operated infrastructure.

Encryption

• In transit: all client-to-server traffic uses TLS 1.2 or higher, with TLS 1.3 preferred. HSTS is enabled with a two-year max-age and includeSubDomains; preload.
• At rest: all stored data is encrypted with AWS KMS customer-managed keys. Database snapshots and backups inherit the same encryption.
• Secrets: credentials, API keys and signing keys are stored in AWS Secrets Manager or SSM Parameter Store (SecureString), never in source control.

Access control

• MFA required for every staff member with access to production. Hardware-key MFA enforced for root-equivalent roles.
• Least-privilege IAM. Production access is scoped to just-in-time roles; standing admin access is minimised.
• SSO + SCIM for staff identity. Off-boarding revokes access within 24 hours.
• Audit logs are retained for 12 months and shipped to a separate, write-once log account.

Application security

• Strict Content-Security-Policy on the marketing site and all dashboards.
• Standard security headers: HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, CORP.
• Dependency vulnerability scanning on every commit (Dependabot + npm audit).
• Static analysis (Semgrep / CodeQL) on every pull request.
• Pen testing at major release boundaries.

Monitoring & response

• Real-time alerting on suspicious authentication and authorization events.
• 24/7 on-call rotation for production-impacting incidents.
• Documented incident-response playbook with named roles and communications templates.
• Customer notification within 72 hours of confirmed personal-data breach (GDPR Art. 33 timeline).

Mobile-specific

• Foreground-only location; never background tracking.
• OAuth/OIDC for federated sign-in with short-lived tokens and refresh rotation.
• Certificate pinning on critical endpoints (rolling, with bypass safety to avoid breakage).
• Local data minimised — sensitive caches expire on session end.

Vulnerability disclosure

If you believe you have found a security vulnerability, we want to hear from you. See our Security Policy & Disclosure Program for scope, safe-harbor terms and response SLAs. Contact: security@thehitsapp.info.

Machine-readable contact: /.well-known/security.txt (RFC 9116).

Standards & certifications

We currently align our controls to SOC 2 Type II and ISO/IEC 27001 frameworks. Formal certifications are in progress; status updates will be published here.