Security at HalalScreener
We treat user data like our own: least-privilege access, hashed credentials, encrypted transit, and a short, auditable subprocessor list.
Architecture
Modern serverless stack with geographic redundancy. No self-managed servers, no direct database exposure, no shared credentials.
Vercel Fluid Compute
Serverless Functions with per-request isolation. US primary region with automatic failover across Vercel's global edge network.
Turso (libSQL)
Primary SQLite database in the US with read replicas at the edge. Daily native backups; point-in-time restore available.
TLS 1.3
Every connection is encrypted with TLS 1.3 (TLS 1.2 at minimum) and terminated directly at Vercel, with no other vendor's proxy or CDN in front. DNSSEC and CAA records are live on the domain. As a .app domain it sits on the browsers' HSTS preload list, so browsers will not load it over plain HTTP.
Data Protection
Every secret at rest is hashed or encrypted. Every byte in transit is authenticated. No user PII ever leaves approved subprocessors.
- API keys are SHA-256 hashed before storage. The plaintext is shown exactly once at creation.
- Magic-link tokens are hashed at rest and expire after 10 minutes.
- TLS 1.3 for modern clients, TLS 1.2 as the floor; TLS 1.1 and older are refused.
- DNSSEC enabled on halalscreener.app to prevent DNS spoofing.
- CAA records restrict certificate issuance to authorized CAs only.
- MTA-STS policy published at /.well-known/mta-sts.txt to enforce TLS on inbound mail.
- HSTS with preload: the .app zone is on the browsers' preload list, so they never send plain HTTP.
Compliance Roadmap
We publish a transparent schedule of every compliance program we run, whether shipped or in progress.
| Program | Status | Target / Evidence |
|---|---|---|
| SOC 2 Type I | In Progress | Vanta engagement, report targeted 2026-Q4 |
| External Penetration Test | Scheduled | Cobalt engagement, scheduled 2026-Q3 |
| GDPR Art. 17 (Right to Erasure) | Live | Self-serve delete at /api/user/delete-account |
| Subprocessor DPA Tracking | Live | Canonical list at docs/SUBPROCESSORS.md |
Public Security Artifacts
The evidence behind the claims on this page. Linkable, machine-readable, and kept up to date.
Report a Security Issue
Have a vulnerability to report, a vendor questionnaire to complete, or a DPA request? Our security contact is monitored during business hours.
security@halalscreener.appWe acknowledge responsible disclosures within 72 hours and aim to remediate SEV-1 issues within 24 hours.