Security Policy

1. Security Overview

At Aika.tools, we are committed to protecting your data and maintaining the highest standards of security. Security is a fundamental aspect of our Service, and we implement industry-standard security measures to safeguard your information.

This Security Policy outlines our security practices, measures, and procedures. We continuously monitor and improve our security posture to protect against threats and vulnerabilities.

2. Authentication & Authorization

2.1 OAuth 2.0 Implementation

We use OAuth 2.0 for secure authentication with calendar providers (e.g., Google). OAuth 2.0 is an industry-standard protocol that allows you to grant limited access to your calendar data without sharing your password. We never store or have access to your calendar provider passwords.

2.2 Session Management

We implement secure session management to protect your account after authentication. Sessions are managed using secure, HTTP-only cookies and are invalidated upon logout or after a period of inactivity.

2.3 Token Refresh

OAuth tokens are automatically refreshed to maintain secure access to your calendar data. Expired or revoked tokens are handled gracefully, and you will be prompted to re-authenticate if necessary.

3. Data Encryption

3.1 Encryption in Transit

All data transmitted between your device and our servers is encrypted using HTTPS/TLS (Transport Layer Security). This ensures that your data cannot be intercepted or read by unauthorized parties during transmission.

3.2 Encryption at Rest

Sensitive data stored in our databases is encrypted at rest using industry-standard encryption algorithms. This includes calendar data, OAuth tokens, and other sensitive information.

3.3 Calendar Data Encryption

Your calendar data is encrypted both in transit and at rest. We use strong encryption standards to protect your event information, attendee data, and calendar metadata.

4. Access Controls

4.1 User Authentication

Access to the Service requires authentication through OAuth 2.0. Only authenticated users can access their own calendar data and account information.

4.2 Permission-Based Access

We implement granular permission controls that allow you to control what information contacts can see. You can configure permission levels for each contact, determining what calendar information they can access.

4.3 Contact Permission System

Our contact permission system ensures that calendar information is only shared with contacts you explicitly authorize. You maintain full control over who can see your calendar and what information they can access.

4.4 Administrative Access

Administrative access to our systems is restricted to authorized personnel only. We implement the principle of least privilege, ensuring that administrators only have access to the minimum necessary data and systems.

5. Third-Party Security

5.1 Google OAuth Security

We integrate with Google's OAuth 2.0 service, which implements industry-standard security measures. Google's security practices are subject to their own security policies and certifications.

5.2 Supabase Security

We use Supabase for our backend infrastructure, which provides enterprise-grade security features including encryption, access controls, and compliance certifications. Supabase's security practices are documented in their security policies.

5.3 API Security

Our API endpoints are secured using authentication tokens and rate limiting to prevent abuse. API requests are validated and sanitized to prevent injection attacks and other security vulnerabilities.

6. Incident Response

6.1 Security Incident Procedures

We have established procedures for detecting, responding to, and recovering from security incidents. Our incident response team is trained to quickly identify and mitigate security threats.

6.2 User Notification

In the event of a security incident that may affect your data, we will notify affected users as soon as practicable. Notifications will include information about the incident, potential impact, and recommended actions.

6.3 Vulnerability Reporting

If you discover a security vulnerability, please report it to us through the Service or our website. We take security vulnerabilities seriously and will investigate and address them promptly.

7. Compliance

7.1 GDPR Considerations

We are committed to compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. Our security measures support GDPR compliance by protecting personal data and enabling data subject rights.

7.2 Data Protection Standards

We follow industry best practices and standards for data protection, including encryption, access controls, and secure development practices. We regularly review and update our security measures to align with evolving threats and standards.

8. Security Best Practices for Users

While we implement strong security measures, you can also help protect your account by:

• Using a strong, unique password for your Google account
• Enabling two-factor authentication on your Google account
• Regularly reviewing and revoking access to third-party apps
• Keeping your devices and browsers up to date
• Not sharing your account credentials with others
• Reviewing your calendar permissions and contact access regularly

9. Security Updates

We regularly update our security measures and practices to address new threats and vulnerabilities. Security updates may include patches, configuration changes, and improvements to our security infrastructure.

We recommend that you keep your devices and browsers updated to ensure you benefit from the latest security protections.

10. Contact Information

If you have questions about our security practices or wish to report a security concern, please contact us through the Service or visit our website at aika.tools.