Authentication and Access Control
| Control | Implementation |
|---|---|
| Password storage | bcrypt with salt (cost factor ≥ 12); plaintext passwords never written to disk or logs |
| Session management | Server-side sessions with signed, HttpOnly cookies |
| CSRF protection | Per-request CSRF tokens required on all state-changing operations |
| Login rate limiting | Multiple failed attempts within a short window trigger a temporary account lockout |
| Bot protection | reCAPTCHA v2 on login and registration forms |
| Admin bootstrap | Admin accounts created only via server environment variables on first startup — no UI promotion path |
Data Encryption
| Data | Encryption |
|---|---|
| Client API credentials (Apify, Groq, etc.) | AES-256-GCM at rest; keys held in environment secrets |
| Data in transit | TLS 1.2 minimum on all connections, enforced at the hosting layer |
| Database | Encrypted storage provided by Neon (PostgreSQL) hosting layer |
PII Controls on Scraped Data
Public review and social content retrieved via Apify passes through two controls before entering the processing chain:
- Field whitelist: Only review text, approximate timestamp, and a non-reversible content hash are retained. All identity metadata — author username, display name, owner ID, profile photo URL, post URL, child posts — is discarded at ingestion.
- Structured-PII redactor: Email addresses, E.164-format phone numbers, and @handles in the text body are replaced with redaction markers before storage. Personal names are addressed by policy rather than automated redaction — see our Privacy Policy for detail.
Audit Logging
An append-only audit log records all significant platform events including:
- Login and logout events (success and failure)
- Failed login attempts and account lockout events
- Admin cross-tenant access events
- Account self-deletion events
- Credit grant and deduction events
Entries include actor identity, event type, timestamp, and relevant detail fields. Logs are retained for two years.
Data Retention
| Data category | Retention |
|---|---|
| Analytical run inputs (URLs, configuration) | Auto-purged 7 days after run completion |
| Analytical run outputs (reports, processed data) | Retained for 365 days |
| Account and session data | Until account deletion |
| Audit logs | 2 years |
Sub-Processor Security
| Sub-processor | Security posture |
|---|---|
| Apify Technologies s.r.o. | SOC 2 Type II in progress; GDPR-compliant infrastructure |
| Groq, Inc. | SOC 2 Type II; data not used for model training |
| RunPod, Inc. | Isolated GPU containers; no persistent storage between jobs |
| Google LLC | ISO 27001, SOC 2, SOC 3 |
| Replit, Inc. | SOC 2 Type II |
| Neon, Inc. | SOC 2 Type II; data encrypted at rest and in transit |
Network-Level Controls
| Control | Implementation |
|---|---|
| DDoS protection | Volumetric and application-layer DDoS mitigation is handled at the hosting layer before traffic reaches the application |
| Rate limiting | API endpoints are rate-limited per IP and per authenticated session to prevent abuse and resource exhaustion |
| Firewall | Inbound traffic is restricted to expected ports and protocols at the infrastructure level; administrative interfaces are not publicly exposed |
| TLS termination | All TLS is terminated at the edge; internal traffic between platform components does not traverse the public internet |
Responsible Disclosure
If you believe you have found a security vulnerability in any Marres Insights service, we ask that you disclose it to us responsibly before making any information public.
- Contact: Email marresinsights@gmail.com with a description of the issue, steps to reproduce, and any relevant evidence.
- Acknowledgement: We will acknowledge receipt within 5 business days.
- Resolution commitment: We will investigate promptly and keep you informed. For confirmed vulnerabilities we target remediation within 30 days, or sooner depending on severity.
- Coordination: We ask that you give us a reasonable window to remediate before any public disclosure. We will not pursue legal action against researchers who act in good faith and follow this process.
We do not currently operate a paid bug-bounty programme, but we will credit researchers by name in incident post-mortems where they consent to it.
Incident Response
In the event of a suspected security incident: the affected service is isolated; scope is determined through investigation; affected clients are notified within 72 hours of a confirmed breach per our DPA obligations; a post-incident report is prepared for internal review.
Contact
Security enquiries: marresinsights@gmail.com
Marres Insights Pte Ltd · Singapore