Our security practices

This article covers Paathz security at depth — useful for corporate IT, regulated employers, or security-conscious users who want specifics beyond the high-level picture.

• Infrastructure: major cloud provider, SOC 2 Type II + ISO 27001 data centers.
• Encryption: TLS 1.3, HSTS, AES-256 at rest, KMS-managed keys with rotation.
• Application: OWASP Top 10 protections, bcrypt hashing, TOTP 2FA, rate-limiting.
• Access: principle of least privilege, all production access logged.
• Incident response: 72-hour user notification for breaches, public post-incident summaries.