Security Policy

Account Security

• Passwords stored with industry-standard hashing (bcrypt)
• Two-factor authentication (2FA) available for all accounts
• Session management — view and revoke active sessions anytime
• Login attempt rate-limiting and lockout protection

Encryption

All traffic encrypted with TLS 1.2+. Data at rest encrypted on our servers. API tokens are hashed — we never store them in plaintext.

Access Controls

• Role-based access within your tenant (admin, staff, viewer)
• Tenant data isolation — one tenant cannot read another's data
• Internal staff access limited to support/operations needs, logged

Backups & Availability

Automated daily backups with point-in-time recovery. Multi-zone infrastructure targeting high availability. See our Uptime Policy for commitments.

Monitoring & Incident Response

Continuous monitoring for anomalies. Security incidents are triaged with defined SLAs; affected customers notified per our Data Protection Policy.

Responsible Disclosure

Found a vulnerability? Report it to security@invozeo.com. We commit to acknowledging reports within 48 hours and not pursuing good-faith researchers.