Your Data Security with Causey: Our Commitment

We deeply value the trust you place in us, and we take the security of your personal and organizational data very seriously. Here's how we protect it:

1. Transmission and Storage

Secure Data Transmission: All data exchanged with Causey is encrypted in transit using TLS (HTTPS). Plain HTTP requests are redirected to HTTPS, and HSTS is enabled.

World-Class Hosting: Causey's web application and primary database run on Render in Oregon, USA, behind Cloudflare for TLS and DDoS protection. Uploaded files and database backups are stored in Amazon Web Services (AWS) S3.

Backups and Redundancy: Every change to your data is continuously replicated, usually within about a minute, to encrypted storage in AWS's Ireland region, with a 7-day point-in-time recovery window. We also take a full snapshot every night, and an automated test restores our backups every week to prove they work. For cross-infrastructure assurance, we periodically copy a full snapshot to Google's cloud infrastructure.

2. Best-in-Class Payment Security

Our partnership with Stripe ensures that all your credit card information is processed securely. Card details are entered on Stripe's own checkout page and never touch our servers. Stripe is certified as a PCI Service Provider Level 1. You can learn more on Stripe's website.

3. Account and Password Protection

Passwords are never stored in plain text. They are hashed using argon2, a modern password-hashing algorithm. Passwords must be at least 12 characters long and can't be common dictionary words.

Within each organization, role-based permissions (such as Administrator, Editor, Contributor and Viewer) control who can see and change your plans.

4. Data Management

Expunging Data: If you ever decide to leave Causey, we respect your data rights. Upon request, we'll permanently delete your data from our systems within 90 days. Copies in our rolling backups expire on their own schedule after that. Email help at causey dot app to start that process.

Retention: If your subscription ends, your account becomes read-only 30 days after it expires. Your data stays available in read-only mode until you ask us to delete it.

Third-Party Partners: We share data only with the services needed to run Causey: Render and AWS (hosting and storage), Cloudflare (network security), Stripe (payments), SendGrid (email delivery), Honeybadger and Skylight (error and performance monitoring), Help Scout (customer support), Google reCAPTCHA (spam protection) and api2pdf (PDF exports).

5. IT and Internal Protocols

Our team relies on Google Workspace Business Apps for various operations, and we prioritize security by enforcing multi-factor authentication (MFA).

Every service or vendor we consider is vetted using an approval process for security.

6. Continuous Monitoring and Audits

We are proactive. Every code change is automatically scanned for outdated or insecure dependencies and checked with static code analysis for potential vulnerabilities. Production is monitored around the clock for errors, uptime, failed background jobs and backup health.

7. Legal Documents

For detailed information on our terms and how we handle data, please see our Privacy Policy and Terms of Service.

The above information is provided for transparency and is not intended to form a binding contract or guarantee. While we strive to ensure the utmost security for your data, no system is infallible. We recommend users maintain their own backups and employ good security practices in their interactions online. Always consult our official Terms of Service and Privacy Policy for definitive information on how we handle and protect data.