Project Factory

← All policies

Security Policy

Version 2026-08-10.1

Reporting a vulnerability

Email security@hanovertech.net with enough detail to reproduce the issue. We acknowledge within two business days and aim to give you a remediation timeline within ten. We will not pursue legal action against anyone who reports in good faith, stays within the boundaries below, and gives us reasonable time to fix the problem before disclosing.

In scope: the Project Factory control plane and applications hosted on apps.hanovertech.net.

Out of scope: denial of service, social engineering of our staff or customers, physical attacks, findings that require a compromised end-user device, and automated scanner output without a demonstrated impact.

How we protect the platform

  • Access control: operator access is limited to a named allowlist, re-checked on

every request, with sessions that expire in eight hours.

  • Authentication: passwordless, single-use, time-limited sign-in links. Only the

hash of a token is ever stored.

  • Isolation: each project gets its own compute and its own data and storage

bindings. A project can reach only the resources explicitly assigned to it.

  • Secrets: credentials live with the provider that issues them. The control plane

stores binding names and external identifiers, not secret values.

  • Encryption: TLS in transit; encryption at rest by every storage provider we

use.

  • Audit: every state change attributable to a person is recorded in an

append-only log with actor, action, subject, and time.

  • Verification: every generated project is scanned for committed credentials,

undocumented environment variables, missing security headers, unverified webhook signatures, and unhashed tokens before it can reach the launch gate.

  • Backups: daily, with restore tested quarterly against a scratch environment.

Incident response

  1. Contain — suspend the affected project or capability.
  2. Assess — determine what data was reachable and by whom.
  3. Notify — affected customers without undue delay, and within 72 hours where a

personal data breach is involved.

  1. Remediate and record — fix, then write down what would have caught it earlier.

Key rotation

Platform credentials rotate annually and immediately on any suspected exposure or when someone with access departs.