מערכת הגנה ברמת הארגון
Our security program combines layered access controls, encryption, continuous monitoring, and regular security testing to protect your account and data.
Last updated: July 29, 2026
אפס סובלנות אבטחה מחויבות
We maintain a strict security program with layered controls, automated testing in our build pipeline, and continuous monitoring.
Strong security posture
OWASP Top 10 והגנה מתקדמת מפני איומים
Controls designed to defend against the most common modern web threats
בקרת גישה שבורה
Role-based access control with RS256-signed JWTs, session binding, and privilege-escalation checks
כשלים קריפטוגרפיים
AES-256-GCM encryption for sensitive data, with secrets and database credentials managed in a hardened vault issuing short-lived credentials
מתקפות הזרקה
שאילתות עם פרמטרים, זיהוי הזרקות מבוסס AST ו-Row Level Security
תצורת אבטחה שגויה
Automated security testing in our build pipeline and hardened service configuration
רכיבים פגיעים
יצירת SBOM אוטומטית, סריקת תלויות וצינור DevSecOps
זיוף בקשות בצד השרת
SSRF protections with network segmentation between services
Encryption
Strong, standards-based encryption in transit and at rest
Data at Rest — AES-256-GCM
Data in Transit — TLS 1.3
Security Capabilities
The systems and practices protecting the marketplace
Automated Security Testing
Static analysis, dependency and secret scanning run automatically in our build pipeline
Layered Security Controls
Access control, encryption, network segmentation, and monitoring across the platform
Incident Response
Automated alerting on security events, with session revocation and access controls applied during response
Fail-Closed Compliance Checks
Sanctions and watchlist screening blocks money movement when a check cannot be completed
Continuous Monitoring
Automated metrics, logging, and alerting across the platform
Tamper-Evident Audit Trail
Money-movement events are cryptographically signed into an append-only, tamper-evident audit trail.
מסגרת תאימות אבטחה
עמידה מקיפה בתקני אבטחה ארגוניים
אבטחת תשלומים
תקן אבטחת נתונים של תעשיית כרטיסי התשלום - מסגרת תאימות מלאה
GDPR סעיף 32
הרגולציה הכללית להגנת מידע של האיחוד האירופי - אמצעי אבטחה מתקדמים
זכויות נושאי מידע לפי CCPA
חוק פרטיות הצרכן של קליפורניה - מערכת תאימות אוטומטית
צינור DevSecOps
שילוב אבטחה רציף עם ניהול חולשות אוטומטי
Threat Detection & Response
Monitoring, alerting, and containment for security incidents
Automated Detection
תגובה אוטומטית לאירועים
Our Security Practices
The controls and safeguards protecting the marketplace
שאלות ותשובות אבטחה
פרטים טכניים על יישום האבטחה שלנו
How do you test your own security?
Static code analysis, dependency scanning, and secret detection run automatically in our build pipeline, and we perform regular internal security reviews. Independent external penetration testing is part of our certification roadmap.
What happens when a security incident is detected?
Security events raise alerts to our monitoring stack. Depending on the event, we revoke sessions, force re-authentication, and apply access restrictions while we investigate.
How do you protect money movement?
Card payments and seller payouts run on Stripe Connect. Funds are held by Stripe, not in a PlugZ bank account; on separate-charge orders the payment settles in PlugZ's Stripe balance before it is transferred to the seller. Sanctions and watchlist screening runs fail-closed, meaning money does not move if a compliance check cannot be completed, and money-movement events are cryptographically signed into an append-only audit trail.
How are my credentials and sessions protected?
Passwords are hashed and compared in constant time, sessions are bound to their context, and access tokens are RS256-signed and published through a JWKS endpoint. The current signing key has not been rotated yet.
What encryption do you use?
TLS 1.3 in transit, and AES-256-GCM for sensitive data at rest, with secrets and database credentials issued as short-lived dynamic credentials from a hardened vault.
התנסות באבטחה בדרגה צבאית
Join a marketplace built with layered security controls and continuous monitoring.
"Security controls built into the platform, not bolted on."