Security overview
Security at The Art of CTO
How we protect customer data, the controls we operate, and how to report a vulnerability. Designed to answer the questions a procurement or risk team is going to ask.
Last reviewed: September 2026 · Owner: security@theartofcto.com
At a glance
- Defence in depth. Authentication, CSRF, rate limiting, input validation, output encoding, and security headers — controls layered, not stacked.
- Least privilege. Admin endpoints gated by role; internal worker endpoints gated by per-prefix shared secrets; secrets scoped per-environment.
- Aligned to ISO 27001 / SOC 2 principles. We operate to the controls; we are not currently independently audited. We are transparent about that gap. See Compliance & alignment.
- No card data on our systems. All payments routed through Stripe (PCI DSS Level 1). We never see, transmit, or store full card numbers.
- Disclosure path. Email security@theartofcto.com for vulnerability reports. Acknowledged within 48 hours.
- Procurement-ready answers. Our CAIQ-aligned security questionnaire answers 50+ standard questions in CAIQ v4 format — extract directly into your vendor risk register.
- Live security status. The security status dashboard publishes the current state of every automated control we run — vulnerability scans, DAST/SAST tools, header validators, certificate-transparency monitors, accessibility scans. Those tiles update straight from CI with no operator gating. A few tiles cover things no scanner can observe — the last disaster-recovery drill, the last tabletop exercise — and are marked as operator-reported.
Application security
Authentication
OAuth 2.0 + OIDC via Auth0 with JWT signature verification (JWKS). Session cookies are AES-GCM encrypted; HttpOnly, Secure, SameSite=Lax.
CSRF protection
Double-submit cookie pattern on every state-changing endpoint. The token is a 256-bit random value issued in a __Host--prefixed, SameSite=Strict cookie and echoed in a header; a missing or mismatched token rejects with 403 before handler dispatch.
Webhook signature verification
Stripe webhooks verified via HMAC-SHA256 with timing-safe compare and 5-minute timestamp tolerance. Idempotent event handling via a dedicated processed-events ledger to defend against replay.
Input validation
Request bodies are validated before use — Zod schemas on newer routes, shared validation helpers elsewhere. Bounded string fields. JSONB payload sizes capped to prevent log abuse.
Rate limiting
Sliding-window rate limiter per endpoint, counted in a Durable Object so the window cannot be split across edge locations. Stricter limits on auth, payment, and contact endpoints.
XSS prevention
Markdown and MDX content is sanitised through rehype-sanitize before render, stripping scripts, embedded frames and javascript: URIs. React escapes interpolated values by default and dangerouslySetInnerHTML is not used on user-supplied content.
SQL injection
Parameterised queries throughout; no string concatenation into SQL. A repository pattern check for SQL interpolation runs in the pre-commit validate step, our REST security suite fires injection payloads at public search, content and lookup endpoints, and the daily CodeQL scan covers the same class of defect.
Secrets
Stored in Cloudflare Workers Secrets and GitHub Actions secrets, never committed to git. Gitleaks scans the full repository history daily in CI.
PII redaction
Server logs run through a sanitiser that masks emails, phone numbers, SSNs, and credit-card patterns before they reach the log sink.
Infrastructure security
Edge runtime
Cloudflare Workers — V8 isolates, no shared filesystem, ephemeral by design. Network-layer DDoS protection inherited from the Cloudflare network.
Encryption in transit
TLS 1.2+ enforced site-wide. HSTS with includeSubDomains and preload. Automatic certificate management via Cloudflare.
Encryption at rest
All Postgres databases (Neon) and object storage (R2) encrypted at rest. KMS-managed keys.
Database access
Application talks to Postgres only via Cloudflare Hyperdrive (TLS). No direct public Postgres exposure.
Backups
Daily automated snapshots; point-in-time recovery within the last 7 days. Cross-region replication for production data.
Network isolation
API and web are separate Workers; admin endpoints require an authenticated admin session and CSRF token. Internal worker-to-worker endpoints require a per-prefix shared secret held only by the calling workers, not user credentials.
Honeypot detection
Around 70 honeypot paths log bot scans to KV with a 30-day retention. Scans get an ordinary 404 with no additional signal, so a scanner cannot distinguish a honeypot from any other missing path.
Data handling
What we collect. Account identity (email, name) via your identity provider; tool inputs and outputs you submit to the platform; telemetry on tool usage and conversion events to improve the product. We do not collect, sell, or share personal data with third parties for advertising.
Where it lives. Application data lives in Neon Postgres (encrypted at rest). Files and audio assets in Cloudflare R2. Logs and rate-limit state in Cloudflare KV. Payment data is held by Stripe — never by us.
How long we keep it. Account data retained for the lifetime of the account. After account deletion, primary records are removed within 30 days; backups roll over within 90 days. Audit and security logs retained for 12 months.
Your rights. You can request export or deletion of your data at any time by emailing privacy@theartofcto.com. We honour GDPR / UK GDPR access, rectification, erasure, and portability requests within 30 days.
Sub-processor changes. We notify customers of new sub-processors at least 30 days before they begin processing data. Customers may object during that window.
Sub-processors
Every third party that processes data on our behalf, grouped by what it is for. This table and the full register at /subprocessors render from one definition, so the two cannot disagree. The register adds what each provider receives, the notice period for changes, and a list of providers commonly assumed to be in use that are not.
Providers marked no personal data are listed for completeness rather than because they hold anything about you. Entries marked [TO CONFIRM] are hosting regions we have not yet verified against the provider's own console — we would rather show the gap than publish a region we cannot evidence. We do not restate providers' certifications here; current attestations come from each provider's trust centre rather than from a table we maintain by hand.
| Provider | Purpose | Region |
|---|---|---|
| Infrastructure and hosting | ||
| Cloudflare, Inc. (USA) | Edge delivery, DNS, DDoS protection, the Workers runtime that runs the site and API, R2 object storage (uploads, hero images, audio), KV (sessions, rate limits, AI assistant history), D1 (cache tags), Hyperdrive (database connection pooling), and the container that runs our malware scanner. | Global edge network. R2 buckets are configured without a jurisdiction restriction, so object placement is automatic rather than region-pinned. |
| Cloudflare Turnstile (Cloudflare, Inc.) | Bot protection on public forms — contact, CTO Office inquiries, waitlist, invitations. | Global edge network. |
| Cloudflare Zaraz (Cloudflare, Inc.) | Consent-gated loading of third-party analytics and advertising scripts. Zaraz decides which of the tools below are allowed to load, based on your consent choices. | Global edge network. |
| Neon, Inc. (USA) | Managed PostgreSQL hosting for all application databases. | [TO CONFIRM: Neon project region — not pinned in repository configuration] |
| Identity, payments and email | ||
| Okta, Inc. / Auth0 (USA) | Identity provider — sign-in, sign-up, multi-factor authentication, passkeys. | [TO CONFIRM: Auth0 tenant region — repository configuration comments indicate an Australian tenant (*.au.auth0.com)] |
| Stripe, Inc. (USA) | Payment processing, subscription management and the customer billing portal. | Global (US-headquartered, EU entity for EEA customers). |
| Brevo (Sendinblue SAS, France) | Transactional email and newsletter delivery. | European Union. |
| Google LLC — Firebase Cloud Messaging, and Apple Inc. — APNs | Delivery of web and mobile push notifications. | Global (Google, USA / Apple, USA). |
| Analytics and advertising | ||
| PostHog, Inc. | Product analytics, funnels, retention, session recording on public pages, and application error tracking. Also the destination for our Workers runtime logs. | PostHog Cloud EU (eu.i.posthog.com). Browser traffic is proxied through p.theartofcto.com before reaching PostHog. |
| Google LLC — Google Analytics 4 | Website analytics. Loaded through Cloudflare Zaraz only after you grant analytics consent. | Global. |
| Microsoft Corporation — Clarity | Behavioural analytics, heatmaps and session recording. Loaded through Cloudflare Zaraz, and only after you grant analytics consent. Unlike PostHog, it is not currently limited to public pages. | Global. |
| Google LLC — Google Ads and AdSense | Advertising and conversion tracking. Loaded only after you grant marketing consent. | Global. |
| Google LLC — Search ConsoleNo personal data | Search performance data for our own domain, used by the SEO tooling. | Global. |
| AI and content generation | ||
| Cloudflare AI Gateway (Cloudflare, Inc.) | Proxy in front of our AI providers, used for routing, caching and cost control. Because it sits in the path, it observes and logs the prompts and completions that pass through it. | Global edge network. |
| OpenAI, L.L.C. (USA) | AI inference for the AI Assistant, Foundry, 1:1 suggestions, article and briefing generation, image generation, and outage analysis. Routed via Cloudflare AI Gateway. | United States. |
| Cloudflare Workers AI (Cloudflare, Inc.)No personal data | Second-opinion inference pass on generated content — the PosterBot refine step, the admin "Refine with AI" action, and the Daily Sync voice pass. | Cloudflare edge network. |
| ElevenLabs, Inc. (USA)No personal data | Text-to-dialogue audio generation for the Daily Sync briefing and short-form video. | United States. |
| TavilyNo personal data | Web search for content research and source verification in our content pipelines. | [TO CONFIRM: processing region] |
| DataForSEONo personal data | Search-engine ranking and AI-visibility data for the SEO Command Center. | [TO CONFIRM: processing region] |
| Operational tooling | ||
| Slack Technologies (Salesforce, Inc.) | Internal operational alerting to our own private workspace. | Global. |
| GitHub, Inc. (Microsoft)No personal data | Source code hosting, CI/CD, and build/deployment metadata read by our admin tooling. | Global. |
| Google LLC — YouTube Data APINo personal data | Publishing our own short-form video content. | Global. |
| Have I Been Pwned (Superlative Enterprises Pty Ltd, Australia) | Breach-exposure monitoring for our own operator accounts, shown on the internal security dashboard. | Australia. |
Compliance & alignment
Honest framing. The Art of CTO is operated to the principles of ISO 27001:2022 and SOC 2 Type II. We have implemented controls across the relevant Annex A families, but we are not currently audited or certified by an independent third party. We list the gap transparently — pretending otherwise would be a control failure in itself. Independent attestation is on our roadmap; in the meantime, the table below shows what we operate today.
Standards we map to. ISO 27001:2022 (Annex A) · SOC 2 Type II Trust Services Criteria (Security, Availability, Confidentiality) · GDPR / UK GDPR · CCPA. PCI DSS scope is fully delegated to Stripe.
Documents available on request. Data Processing Agreement (DPA) · Sub-processor list (live in this page) · Information security policy · Incident response policy · Vulnerability disclosure policy · Internal security review findings. We have not yet commissioned an independent penetration test; when we do, the summary will be listed here. Email security@theartofcto.com.
ISO 27001:2022 Annex A — controls we operate
| Annex | Control family | What we do |
|---|---|---|
| A.5 | Information security policies | Security policy reviewed annually; published policies for incident response, vulnerability disclosure, and acceptable use. |
| A.6 | Organisation of information security | Defined roles and responsibilities; security@theartofcto.com as a single intake for all reports. |
| A.7 | Human resource security | Access provisioned on a need-to-know basis; offboarding revokes credentials within 24h. |
| A.8 | Asset management | Inventory of data stores, sub-processors, and binding configurations under version control. |
| A.9 | Access control | OAuth 2.0 / OIDC authentication via Auth0; AES-GCM encrypted sessions with HKDF-SHA256 key derivation; CSRF double-submit cookies on state-changing endpoints; role-based access for admin features. |
| A.10 | Cryptography | TLS 1.2+ for all external traffic; HSTS preload; AES-GCM session encryption; HMAC-SHA256 webhook signature verification (Stripe); secrets managed via Cloudflare Workers Secrets, never committed. |
| A.11 | Physical & environmental | Inherited from sub-processors (Cloudflare, Neon, Auth0). All run physically secure datacenters with ISO 27001 attestation. |
| A.12 | Operations security | Automated dependency scanning (Dependabot, npm audit, retire.js); daily CodeQL static analysis whose findings are parsed and published to our security status dashboard; daily secret scanning across full repository history; structured logging with PII redaction (email, phone, SSN, card-number patterns). A second CodeQL job runs on each pull request, but its results go to GitHub code scanning, which is not enabled on this repository — that job currently publishes nothing and we do not count it as a control. |
| A.13 | Communications security | CSP with explicit host allowlists on every directive and object-src/frame-ancestors set to none — though script-src still permits 'unsafe-inline', which we have not yet removed; X-Frame-Options DENY; X-Content-Type-Options nosniff; Referrer-Policy strict-origin-when-cross-origin; environment-aware CORS origin validation. |
| A.14 | System acquisition, development & maintenance | Unit + integration tests, lint, typecheck and a production build run locally before every commit and again in CI; static analysis runs daily rather than as a merge gate, for the reason given under A.12. CODEOWNERS routes changes touching authentication, payments or PII to the security owner. As a single-maintainer project there is no second-reviewer gate on main. |
| A.15 | Supplier relationships | Sub-processor list (below) maintained and disclosed, and derived from the code rather than from memory. Independent attestation (SOC 2 / ISO 27001) is a selection criterion for providers that hold account, billing or contact data. Where a provider without one is engaged, we bound what it receives instead, and the register says what that is. |
| A.16 | Information security incident management | Application error tracking (PostHog) + Cloudflare Workers Observability for detection; documented incident response runbook; security@theartofcto.com 48h intake commitment; user notification within 72h of confirmed incident affecting their data (GDPR Article 33). |
| A.17 | Business continuity | Multi-region replication via Cloudflare and Neon; daily database backups with point-in-time recovery; restore procedure documented and exercised manually, with the date of the last drill published on the security status dashboard. |
| A.18 | Compliance | GDPR / UK GDPR — DPA available on request, data export and deletion endpoints. CCPA — same. Vulnerability disclosure policy at /security#disclosure. Annual review of legal obligations. |
Vulnerability disclosure
We welcome reports from the security research community. Email security@theartofcto.com with details. PGP key available on request.
Our commitment to you:
- We acknowledge every report within 48 hours.
- We provide a tentative remediation timeline within 5 business days.
- We will not pursue legal action against good-faith researchers who follow this policy.
- We credit reporters publicly (with consent) in release notes.
In return, please:
- Avoid privacy violations, data destruction, denial-of-service, and physical attacks.
- Test only on accounts you own or have explicit written permission to test on.
- Give us reasonable time to remediate before public disclosure.
Out of scope: rate limits on documentation pages, content security policy reports without an exploitable vector, social engineering of staff, theoretical issues without proof of concept, missing security headers without a demonstrated attack.
Contact
- Security: security@theartofcto.com — vulnerabilities, audit requests, security questionnaires.
- Privacy / data rights: privacy@theartofcto.com — GDPR / CCPA requests, DPA copies.
- Legal: legal@theartofcto.com.
We respond within 1 business day to procurement and security questionnaires from prospective customers.