Trust & Security
How we approach security, privacy, and reliability.
This page describes our practices in plain terms. We do not hold third-party security certifications at this time and make no claims to the contrary.
Our practices
Seven areas we hold ourselves to.
These are the practices we apply across product development and operations. They are reviewed as our products and obligations change.
Privacy-minded design
Products are designed to collect the minimum information required to deliver the service, with retention reviewed against operational need.
Role-based access
Access is scoped to product-appropriate roles such as end user, staff, operator, and administrator, with least-privilege defaults for internal access.
Secure development practices
Change review, dependency maintenance, environment separation, and secret management are part of our standard delivery process.
Responsible data handling
Data is handled according to documented purposes, with encryption in transit and controlled administrative access.
Availability & reliability
We monitor our services, maintain backups appropriate to each system, and design for recovery as well as uptime.
Incident response posture
We maintain internal procedures for identifying, containing, and communicating about security or availability incidents.
Vendor & service-provider governance
Third-party services are reviewed before use and re-assessed as our products and obligations change.
Trust resources
Documentation and status.
This section is built to hold security documents, service status, subprocessor information, and any future compliance materials.
Security documentation
Available on request for active and prospective customers under an appropriate agreement.
Service status
A public status page for product availability is planned. Configuration pending.
Subprocessor list
A published list of service providers used to deliver our products is in preparation.
Compliance materials
We do not currently hold third-party security certifications and make no such claims. Any future attestations will be published here.
Still to be published: a public service status page and any security documentation once approved for release. Security reports reach us at security@pickyoutech.com.
Responsible disclosure
Reporting a security concern.
If you believe you have found a vulnerability in one of our products, please tell us. Describe the issue at a high level and let us confirm a secure channel before sharing technical detail. We ask that you avoid accessing data that is not yours and give us reasonable time to respond.