Security Policy

1. Security practices

• TLS 1.2+ in transit, encryption at rest for sensitive data.
• Role-based access control with least privilege.
• Regular dependency scanning and patching.
• Logging and monitoring across services.
• Annual third-party penetration testing.
• Vendor security review before onboarding.

2. Breach notification procedures

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify affected users and competent authorities within 72 hours of becoming aware, as required by GDPR Art. 33–34 and equivalent laws.

3. User responsibilities

• Use a unique, strong password.
• Enable two-factor authentication where available.
• Do not share credentials.
• Report suspected security issues to security@instantquotecreator.com.

4. Responsible disclosure

We welcome reports from researchers. Do not access data that is not yours, do not exfiltrate data, and give us reasonable time to remediate before public disclosure. Coordinated disclosure contact: security@instantquotecreator.com.