Security Policy

1. Commitment

AInexfinder takes the security of our platform and the personal data we process seriously. This Security Policy summarizes practices we use to protect the Service. It is not a certification report (for example, SOC 2) and does not create warranties beyond our Terms and Privacy Policy.

---

2. Scope

This Policy covers the AInexfinder website, applications, and backend systems we operate. It does not cover security of third-party AI tools listed in the directory.

---

3. Security Measures

Depending on system and risk, measures may include:

3.1 Transport security

• HTTPS/TLS for data in transit
• Security headers where configured

3.2 Access control

• Role-based access for administrative functions
• Least-privilege principles for staff and systems
• Authentication for user accounts via secure auth providers

3.3 Application security

• Input validation and output encoding practices
• Protection against common web vulnerabilities as part of development standards
• Dependency and patch management on a reasonable cadence

3.4 Infrastructure

• Reputable cloud hosting and edge providers
• Network protections and monitoring appropriate to our scale
• Backups and recovery procedures

3.5 Logging and monitoring

• Security-relevant logs for investigation and abuse detection
• Rate limiting and anti-abuse controls on sensitive endpoints

3.6 Organizational practices

• Limited employee access to production data
• Confidentiality expectations for team members and contractors

---

4. Payment Security

When payments are processed by Paddle as Merchant of Record, cardholder data is handled in Paddle’s PCI-compliant environment. AInexfinder does not store full payment card numbers from Paddle checkout.

---

5. Your Responsibilities

You agree to:

• Use strong, unique passwords
• Protect account credentials and devices
• Notify us of suspected unauthorized access
• Not attempt to breach or probe systems except via coordinated disclosure

---

6. Vulnerability Reporting

If you believe you found a security vulnerability in AInexfinder:

1. Email legal@ainexfinder.com or hello@ainexfinder.com with subject “Security Vulnerability”
2. Provide a clear description, steps to reproduce, and impact assessment
3. Do not access data that is not yours, destroy data, or disrupt the Service
4. Allow us a reasonable time to investigate before public disclosure

We appreciate good-faith researchers. We may not offer a paid bug bounty unless we publish one.

---

7. Incident Response

If we become aware of a personal data breach affecting the Service, we will investigate and notify affected users and authorities as required by applicable law (including GDPR timelines where applicable).

---

8. Third-Party Services

We use processors (hosting, auth, email, analytics, payments). We select providers with security practices appropriate to their role and bind processors contractually where required. Their security is also governed by their own policies.

---

9. No Absolute Security

No online service can guarantee absolute security. You use the Service understanding residual risk. See liability limits in our Terms.

---

10. Updates

We may improve security practices over time and update this Policy accordingly.

---

11. Contact

Security / legal: legal@ainexfinder.com
Support: hello@ainexfinder.com
Privacy: privacy@ainexfinder.com