Security is a core product requirement at Setkin. This page explains the technical, organisational, and operational measures we use to protect your account, your business data, and every review on the Platform. We publish this page so contractors, reviewers, and their customers can make informed decisions about using Setkin.
1. Our commitment
Setkin stores sensitive business and account information — from login credentials to payment status to confidential customer feedback. We treat securing that data as a first-class engineering concern, not an afterthought. Our security programme is reviewed regularly and updated as the threat landscape evolves.
2. Encryption in transit and at rest
All traffic to and from the Platform is served over TLS 1.2 or higher with modern cipher suites. Data at rest is encrypted at the storage layer. Secrets stored in the Platform — such as third-party API credentials saved by an administrator — are encrypted with AES-256-GCM using a rotating encryption key before they ever touch the database. Session cookies are HTTP-only, Secure, and SameSite=Lax.
3. Authentication and access control
Account access is protected by a strong password policy plus optional two-factor authentication (TOTP, compatible with Google Authenticator, Microsoft Authenticator, and 1Password). Sessions are issued as short-lived access tokens with a rotating refresh token. Administrative access to production systems is restricted to a small number of engineers, protected by multi-factor authentication, and logged in an immutable audit trail.
4. Review integrity
Every direct customer review within our app is verified by a unique code before it is published. The code is generated on the server, hashed before storage, expires in 10 minutes, and is delivered via an authenticated transactional email provider. Rate limits, duplicate detection, and fingerprinting are applied at submission to reduce the risk of fake reviews. TrustScore is calculated from verified reviews only. Reviews imported from other platforms such as Google Reviews, Trustpilot, Yell, etc., are reviewed and verified by our team before they go live.
5. Infrastructure and network security
The Platform runs on hardened cloud infrastructure with network isolation, managed databases, automated backups, and continuous monitoring. We apply security patches promptly and run periodic vulnerability scans and dependency audits. Production data is segregated from development and testing environments.
6. Data isolation
Business data — reviews, customers, campaigns, and settings — is logically isolated per contractor. Queries are scoped to the authenticated business. Team members can only access the contractor they belong to, and roles restrict what each member can do. Cross-tenant access is prevented at the query layer.
7. Administrative access and audit logging
Admin access is restricted by role, and multi-factor authentication is required on admin accounts. Sensitive actions - user accounts, plans and pricing, support, and platform configuration - are recorded in an immutable, tamper-evident audit log. Each entry is time-stamped, attributed, and hash-chained to the one before it, so any tampering is detectable. All records are permanently secure and their integrity can always be confirmed.
8. Monitoring and incident response
We monitor the Platform for anomalies, failed logins, and unexpected traffic patterns. We maintain a documented incident response plan with defined roles, escalation paths, and communication procedures. On a confirmed security incident affecting personal data, we notify affected users and, where required, the relevant supervisory authority (the ICO in the UK, the relevant EU authority, the CPPA in California, the ANPD in Brazil, the OPC in Canada, or the OAIC in Australia) without undue delay and, where the GDPR applies, within 72 hours.
9. Business continuity and disaster recovery
We maintain backups of critical data and periodically test restoration. Our infrastructure is designed to tolerate the failure of a single component. We document recovery time and recovery point objectives and review them annually.
10. Vulnerability disclosure
If you believe you have discovered a vulnerability in Setkin, please report it responsibly to security@verified.app. Please include enough detail to reproduce the issue — a clear description, steps to reproduce, potential impact, and any suggested fix — and give us reasonable time to investigate before any public disclosure. We commit to acknowledging receipt within 48 hours, providing an initial assessment within 5 business days, and keeping you informed of remediation progress. We will not pursue legal action against researchers who follow this policy, act in good faith, and do not access, modify, or exfiltrate data beyond what is necessary to demonstrate the vulnerability.
11. Third-party security
We will work with a small number of carefully selected service providers who meet our security standards. Each provider is bound by a data processing agreement and is expected to maintain industry-standard controls. We review our critical suppliers periodically.
12. Compliance and certifications
We align our security programme with recognised frameworks including ISO/IEC 27001 and the UK Cyber Essentials scheme. Where we obtain certifications, they will be published on this page. We comply with the security-related requirements of the UK GDPR, EU GDPR, CCPA/CPRA, LGPD, PIPEDA, and the Australian Privacy Act.
13. Your role
You help keep the Platform safe by using a unique password, enabling two-factor authentication, keeping your devices up to date, and reporting anything that looks suspicious. No system is perfectly secure, and layered defence — technical and human — is the goal. If you suspect your account has been compromised, change your password immediately and contact support@verified.app.
14. Contact
For security questions or to report an issue: security@verified.app. For urgent incidents, use the same address and mark your message "URGENT".
