Security Policy
The safeguards we hold ourselves to in running Ranch2Ranch — plainly stated, reviewed every year.
Who owns security
Information security at Ranch2Ranch is owned by the founder — risk decisions, access grants, vendor selection, and incident response all land on one named desk, not a committee. Anyone who works on the platform reads and follows this policy before getting access, and access ends the day their engagement does. Reach the security team any time at security@ranch2ranch.com.
Access control
- Production access follows least privilege — every account is individual and named. No shared logins, no shared keys.
- Multi-factor authentication is required on every internal system that holds production data or secrets.
- Your session is protected by short-lived tokens that rotate automatically, and every sensitive action is re-checked server-side.
- You can add optional two-factor authentication to your own account from Settings.
Secrets management
API keys, database credentials, and signing keys live only in our hosting providers' protected environment configuration — never in source code, never in chat tools. Any credential we even suspect has been exposed gets rotated immediately and the exposure is treated as an incident.
Encryption
- In transit — everything travels over TLS 1.2 or better, between your browser and us and between us and every service we use.
- At rest — all stored data lives in managed services with AES-256 encryption at rest.
- In the application — passwords are hashed with bcrypt; verification codes and session tokens are stored only as one-way hashes. Card numbers never touch our systems (Stripe handles checkout), and identity verification through Plaid leaves us no financial data — just a verified/not-verified flag.
Vulnerabilities & patching
Our code dependencies are scanned continuously and patched as alerts arrive — critical issues within 72 hours. The servers themselves are managed platforms (Render, Vercel) that patch their own operating systems and networks, which means there's no forgotten box in a closet running stale software. Development machines run automatic updates with full-disk encryption.
Our vendors
A short, deliberate list of third parties helps run the platform: Render and Vercel (hosting), Stripe (payments), Plaid (identity verification), Twilio (SMS), Mailgun (email), and Upstash (job queues). Each is reviewed for security posture before adoption and re-checked at the annual policy review.
If something goes wrong
Our incident playbook is contain, assess, notify, learn: rotate affected credentials and revoke sessions first, work out what was touched, tell affected users and partners without undue delay (and regulators where the law requires it), then write up the cause and fix. If you think you've found a security issue, email security@ranch2ranch.com — we read every report.
Retention & deletion
Retention follows our Privacy Policy: account data lives as long as your account does. Delete your account and, after a 30-day grace period, an automated job purges your personal information and anonymizes what's left. Payment records are kept up to 7 years for tax and fraud-prevention purposes, then purged by the same job.
Review cadence
This policy is reviewed annually, and again after any security incident or material change to how the platform is built. The "Last updated" date above always reflects the current version.