On this page
Platform Security Overview
Chase & Marshal designs, builds, and operates the SparkOS platform and associated services with security as a first-class concern. Our security programme is built around the five SOC 2 Trust Service Criteria — Security, Availability, Confidentiality, Processing Integrity, and Privacy — ensuring comprehensive coverage across the entire service lifecycle.
ISMS Policies
Documented security policies covering access control, incident response, and data handling.
Defence in Depth
Multiple overlapping technical controls rather than reliance on any single safeguard.
Privacy by Design
Data minimisation and privacy considerations built into every feature from the start.
NZ & Global Compliance
Aligned with the NZ Privacy Act 2020, GDPR principles, and ISO 27001 best practices.
1. Security
We apply defence-in-depth to protect the platform and its data against unauthorised access, malicious activity, and abuse.
Encryption in Transit — TLS 1.2+
All communication between clients and our servers is encrypted using TLS 1.2 or higher. HTTP connections are automatically redirected to HTTPS. HSTS headers are set to prevent downgrade attacks.
Password Hashing — bcrypt
User passwords are never stored in plaintext. All passwords are hashed using bcrypt with a work factor calibrated to resist brute-force attacks.
Two-Factor Authentication (TOTP)
Time-based one-time password (TOTP) two-factor authentication is available and enforced for administrative accounts. Users may also enable 2FA on their own accounts.
Role-Based Access Control (RBAC)
Access to sensitive data and administrative functionality is restricted using role-based access control. Roles are enforced server-side on every request; client-side rendering of restricted content is not treated as a security boundary.
Session Management
Sessions are issued as signed, server-side cookies. Sessions are invalidated on logout and expire after a period of inactivity. Session tokens are rotated upon privilege escalation.
Security Headers
Our HTTP responses include a Content Security Policy (CSP), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and Referrer-Policy headers to mitigate common web vulnerabilities.
Stripe Webhook Signature Verification
All inbound Stripe webhook events are verified using Stripe's HMAC-SHA256 signature before any business logic is executed, preventing spoofed payment events.
reCAPTCHA on Public Forms
Google reCAPTCHA v3 is integrated on publicly accessible forms (newsletter subscription, contact forms) to mitigate automated abuse and spam submissions.
Penetration Testing
The platform underwent a penetration test in late 2024. Identified findings were remediated and verified. We conduct security reviews periodically and after significant architectural changes.
2. Availability
We operate on reliable cloud infrastructure and take steps to ensure that the platform remains accessible to authorised users.
Cloud Infrastructure
The platform is hosted on Replit's managed cloud infrastructure, which runs on Google Cloud Platform. Infrastructure-level availability, hardware redundancy, and network resilience are managed by the hosting provider.
Database Backups
The PostgreSQL database is backed up daily using automated backup tooling. Backups are retained for a rolling 30-day period. Restoration procedures are tested periodically.
Uptime Monitoring
Application endpoints are monitored for availability. On-call alerting is configured to notify the engineering team of outages so that recovery actions can begin promptly.
Incident Response
We maintain an incident response process that covers detection, triage, remediation, and post-incident review. Critical incidents are communicated to affected customers in a timely manner.
3. Confidentiality
We restrict access to customer data on a need-to-know basis and implement controls to prevent unauthorised disclosure.
Principle of Least Privilege
Team members are granted only the minimum level of access required to perform their role. Access rights are reviewed when roles change and revoked promptly upon offboarding.
Logical Data Separation
Multi-tenant data is logically separated at the application layer. API endpoints validate that requesting users may only access records belonging to their own account or organisation.
Environment Separation
Development and production environments are separated. Production credentials are not used in development or staging environments. Secrets are managed through environment variables, not hardcoded in source code.
Third-Party Sub-Processors
We work with a limited number of trusted sub-processors (including Stripe, Brevo, Google reCAPTCHA, and OpenAI via Replit AI Integrations). Each sub-processor is evaluated for their own security and privacy commitments before use.
File Storage Access Controls
Files uploaded to object storage are stored in access-controlled buckets. Public and private directories are enforced at the storage layer, and pre-signed URLs are used where appropriate.
4. Processing Integrity
System processing is complete, valid, accurate, and authorised.
Input Validation
All API endpoints validate incoming request payloads against strict Zod schemas before processing. Invalid or unexpected data is rejected with an explicit error response, not silently discarded.
Payment Processing via Stripe
All payment transactions are processed by Stripe, a PCI DSS Level 1 certified payment processor. Cardholder data never transits our servers. Webhook events are verified before fulfillment is triggered.
AI Output Review
AI-generated content (via SparkOS features) is presented to users as AI output and is not substituted for professional advice without appropriate disclosure. Outputs are subject to the guardrails and content policies of the underlying model provider.
Structured Error Handling
Application errors are caught and handled explicitly. Unhandled errors are logged for investigation. Error responses to clients do not expose internal system details such as stack traces or database structure.
5. Privacy
We collect only the personal information necessary to provide our services and respect individuals' rights over their data.
Privacy Policy
Our Privacy Policy describes what personal information we collect, why we collect it, how it is used, and who it is shared with. It is publicly available and updated when our practices change.
Cookie Consent & Preferences
We use a cookie consent banner to obtain informed consent before setting non-essential cookies (analytics, marketing). Users can review and update their preferences at any time.
GDPR Alignment
We have identified lawful bases for our personal data processing activities. Data subject rights (access, rectification, erasure, portability, and objection) can be exercised by contacting us at team@chasemarshal.com.
Data Minimisation
We collect the minimum personal data needed to deliver our services. We do not sell personal data to third parties for advertising or data brokerage purposes.
New Zealand Privacy Act 2020
Our privacy practices are designed to comply with the New Zealand Privacy Act 2020 and align with relevant international standards including the GDPR.
Compliance & Policies Hub
Our security and compliance documentation is consolidated here for enterprise customers, auditors, and procurement teams. The links below provide direct access to our full policy library and legal documentation.
ISMS Security Policies
Full policy library: Information Security, Acceptable Use, Access Control, Incident Response, Data Retention, and Change Management.
Privacy Policy
How we collect, use, and protect your personal information in accordance with the NZ Privacy Act 2020 and GDPR.
Cookie Policy
Details on which cookies we set, why, and how to manage your preferences including opting out of analytics cookies.
AI Governance Statement
Our responsible AI principles, bias-testing commitments, model transparency, and human oversight practices.
Compliance Frameworks
ISO/IEC 27001 — Aligned
Our ISMS policies and controls are designed in alignment with ISO 27001 best practices for information security management.
NZ Privacy Act 2020 — Compliant
Our data practices satisfy the Information Privacy Principles of the New Zealand Privacy Act 2020.
GDPR — Aligned
We apply GDPR-compatible data handling principles globally, including lawful basis for processing and data subject rights.
PCI DSS — Delegated to Stripe
Payment card processing is handled exclusively by Stripe, a PCI DSS Level 1 certified provider. Cardholder data never transits our systems.
SOC 2 Trust Service Criteria — Guiding Framework
This page is structured around the five SOC 2 Trust Service Criteria as a recognised standard for cloud service security transparency.
Vulnerability Disclosure Policy
We take security vulnerabilities seriously. If you discover a potential security issue in our platform, we ask that you follow responsible disclosure practices and give us the opportunity to investigate and remediate before making any details public.
How to Report
Send a detailed description of the vulnerability — including steps to reproduce, potential impact, and any supporting evidence — to security@chasemarshal.com. Please do not create public GitHub issues or social media posts for security vulnerabilities.
Acknowledgement — within 48 hours
We will acknowledge receipt of your report within 48 hours of receiving it and provide an initial assessment of its severity.
Investigation & Remediation
We will investigate the report thoroughly and work to remediate confirmed vulnerabilities in a timeframe appropriate to their severity. We will keep you informed of our progress.
Disclosure Coordination
Once a fix is deployed, we are happy to coordinate public disclosure with you and will credit you for the discovery if you wish. We ask that you refrain from public disclosure until we have confirmed the fix is in place.
Responsible Disclosure Contact
security@chasemarshal.comPlease use this address exclusively for security vulnerability reports. For general support, use team@chasemarshal.com.
Questions About Our Security Posture?
Enterprise customers and prospects completing security reviews may contact us at team@chasemarshal.com to request additional information or to discuss specific security requirements.
This page is reviewed and updated at least annually, and following any significant change to our infrastructure or security controls. Last reviewed: April 2026.