SECURITY & TRUST
We build security products, so our own posture should be inspectable. Here is what we do, and honestly what we have not done yet.
How this site is secured
- Served only over HTTPS (TLS), with HSTS including subdomains and preload.
- A content-security policy, frame-deny, MIME-sniff protection, a strict referrer policy and a restrictive permissions policy on every response.
- An intrusion-prevention layer (CrowdSec) enforcing bans at the host firewall.
- Least-privilege access to infrastructure, key-based administrative access only, and automated security patching.
- Encrypted, automated database backups.
Where data lives
Our infrastructure runs in India (AWS Asia Pacific, Mumbai). See the Privacy Policy for what we collect and which third parties are involved.
Certifications - where we actually stand
We hold no third-party security certification at present. We are not ISO 27001, SOC 2 or CMMI certified, and we will not imply otherwise. If certification matters to your procurement process, talk to us about timelines before shortlisting.
Responsible disclosure
If you believe you have found a vulnerability in diigoo.com or any DIIGOO product, email hello@diigoo.com with enough detail to reproduce it. Please give us a reasonable period to fix the issue before disclosing it publicly, and do not access or modify data that is not yours. We will acknowledge your report, keep you updated, and credit you if you would like. Machine-readable contact details are published at /.well-known/security.txt.
Security in client work
Security review is part of delivery rather than a final gate: threat modelling during design, dependency and secret scanning in CI, least-privilege infrastructure by default, and encryption in transit and at rest. See Cybersecurity and the Cybious suite.